06/19/2020: ZLoader Campaign IOCs

Follow me at https://twitter.com/DynamicAnalysis

Reference at https://twitter.com/DynamicAnalysis/status/1274271073597456385

#ZLoader #malspam with .xls attachments.

Downloader URLs include:
https://reinin.tw/wp-keys.php
https://legendcoder.com/wp-keys.php
https://pullingmezcnarcmer.tk/wp-keys.php
https://ruibrunconcallconsta.tk/wp-keys.php

Malware payload:
https://tiilearaphefanpa.gq/g34gc.php

#ZLoader C2s:
https://thebypath.com/wp-parsing.php
https://dramalove.su/wp-parsing.php
https://hongsamlinhchi.vn/wp-parsing.php
https://monquasuckhoe.com/wp-parsing.php
https://nhansamlinhchi.com.vn/wp-parsing.php

XLS Sample:
https://app.any.run/tasks/c231a3ac-37c6-4e69-8f48-17ddcf926fc6/