2020-11-13 ZLoader IOCs

THREAT ATTRIBUTION:  ZLOADER

SUBJECTS OBSERVED
# 595736 Many people from your firm will clearly be mad.
Contract 63397946 reminder
Contract No. 669 data
Document 31516444 reminder
Full summary of the Receipt ## 8332
Nov. Unpaid Invoice
Number 166336 Many people from your firm will definitely become mad.
Number 195425 Some people inside your company will clearly get angry.
Payment number 5650 information
Re: Contract No. 669 data
Statement 69156562 reminder
Statement 71682924 sent by fax
Statement 86089575 sent by fax
Statement documents
You have Overdue Invoice No.# 1509

SENDERS OBSERVED
albertodar@eresmas.com
albertoiradier@ciudad.com.ar
AlexMurray@edinarealty.com
allenchristopher207@aol.com
francescoriol@eresmas.com
kevin_j10@aol.com
leelaura411@aol.com
mervynthomas@btconnect.com
pforbes@wilcoimaging.com
robinsoncarol343@aol.com
sharonkiff@btconnect.com
tac13eka@aol.com
tyco.67@aol.com
wonil@sta.co.kr
yolanda.paula@orange.es

EXCEL FILE HASHES
3628a52f8fe6c09823a7861af19b1cf7
6e3a84162fcae52d578ab632627109eb
91a833ce72cd873b2f52d2cf95294073
cccd84bd8f272472cc76600c52de2587
ee9612753190abfc6e04d980d8f61648
f8dd148774e649e8c4d2c28814e08428
fc4993c58495e9a2bbe584ecf041072d

EXCEL FILE NAMES
1509.xlsm
5650.xlsm
669.xls
8332.xls
8557.xls
request.926.xls
request6635.xls

ZLOADER PAYLOAD
https://b-dvs.com/server.php
https://b-design.studio/errors.php
https://taigen-landscape.com/wp-crunch.php
https://taigen-landspace.com/logs.php

https://topic.miami/wp-data.php
https://topic.yoga/wp-data.php

b-dvs.com
b-design.studio
taigen-landscape.com
taigen-landspace.com
topic.yoga
topic.miami

ZLOADER C2s
https://azoltd.myzen.co.uk/errors.php
https://enmasucitessee.tk/wp-smarts.php
https://mandreskincare.com/wp-smarts.php
https://moisbridge.co.uk/cp-panel.php
https://pousadadosolbuzios.com.br/wp-smarts.php
https://telkfitness.protekgr.com/errors.php
https://tfbuildingjoinery.co.uk/errors.php