07/01/2020: ZLoader Campaign IOCs

https://twitter.com/DynamicAnalysis/status/1278359026690961408

#ZLoader #malspam with .xls attachment from today has a slight change... No redirect was found to a secondary domain where the .dll was downloaded.

Below are the downloader URLs:

s://megamaq.com.ar/wp-keys.php
s://vietankhe.com.vn/wp-keys.php
s://bangrajan.org/wp-keys.php
s://noithatthongminhamd.com/wp-keys.php

#ZLoader C2s:

https://alginis.com/wp-parsing.php
https://stockgainers.in/wp-parsing.php
https://poikatamanfang.gq/wp-parsing.php
https://tjiowa.com/wp-parsing.php
https://pmi-print.de/wp-parsing.php
https://anuki.in/wp-parsing.php
https://cloudguchenleteli.gq/wp-parsing.php

XLS sample:
https://app.any.run/tasks/ba0b4739-44ec-4d0f-ab91-092acd037384#