2020-10-28_Japanese-malspam_with-Zloader

<Subjects>
注文番号 AX000000-000000
# X is random charactor, 0 is random number

<Attached File>
0000000.zip　-> 0000000.xlsb
# 0 is random number

<sample>
https://app.any.run/tasks/8ab07f7b-0467-4e9f-b29e-db971531c65c/
https://app.any.run/tasks/0c54ff74-a70d-4e02-89dc-39dc82bab8a9/

<Payload URL>
# 3 patterns depending on the attached file
hxxp://nightsalmon[.]xyz/campo/b/b
(207.154.210[.]66)
->
hxxp://tropicribs[.]com/wp-content/uploads/estate_templates/n1.exe
(206.188.193[.]51)

hxxp://foreverbold[.]xyz/campo/b/b
(207.154.210[.]66)
->
hxxp://casevacanza[.]pro/wp-content/uploads/estate_templates/n1.exe
(54.36.88[.]52)

hxxp://superstartart[.]xyz/campo/b/b
(207.154.210[.]66)
->
hxxp://www.brevmex[.]com/wp-content/uploads/estate_templates/n1.exe
(160.153.72[.]68)

<Payload>
https://app.any.run/tasks/d5151d34-4534-4441-ae20-74baa2b5afea/

<C2>
hxxps://notsweets[.]net/LKhwojehDgwegSDG/gateJKjdsh.php