2020-09-22 ZLoader IOCs

THREAT ATTRIBUTION:  ZLOADER

SUBJECTS OBSERVED
Given invoice clarification, ID7992
Given invoice information, id#9751
Invoice  4459
Payment id 8401 details
This is your Reminder for Invoice
Your Service Invoice# 3171

SENDERS OBSERVED
britkanlava86984@aol[.]com
diejecri325134@aol[.]com
golfpurtixi734041@aol[.]com
heralu452163@aol[.]com
jenniferadams689@aol[.]com
stevennelson287@aol[.]com

EXCEL FILE HASHES
69cd0d8dce170b749a0a397d8c221ded
ecc1472f5924f68ba3248529cf197ac9
a301847a50ce12de68966fe28cdf1cc0
94e0b5238b8643145dafb1a459d04de5

EXCEL FILE NAMES
DE[.]2615[.]xls
EXI_8401.xls
R-9751[.]xls
CM[.]3171[.]xls

ZLOADER PAYLOAD FILE HASHES
None

ZLOADER PAYLOAD URLs
hxxps://loveleigh[.]seo-and-web-design[.]com/wp-touch[.]php
hxxps://marketingblueprints[.]club/wp-touch[.]php
hxxps://polyet-store[.]com/wp-touch[.]php
hxxp://msbibo[.]ch/wp-touch[.]php
hxxps://chuguadventures[.]co[.]tz/wp-touch[.]php
hxxps://cirabelcr6dito[.]com/wp-touch[.]php
hxxps://digitalseven[.]net[.]co/wp-touch[.]php
hxxps://dortome[.]net/wp-touch[.]php

ZLOADER C2s
Unknown