2020-07-08 ZLoader IOCs

SUBJECTS OBSERVED
Additional information about receipt id#315
Contract No. 472 data
Invoice reminder
Invoicing id 136 information

SENDERS OBSERVED
hopcondegnarh1@aol[.]com
janailla[.]tuldo@aol[.]com
toidecanshinybarrel26@aol[.]com
walredvooshnak@aol[.]com

EXCEL FILE NAMES
Inv_691.xls
Qt_315.xls
rec136[.]xls
Ref_472.xls

EXCEL FILE HASHES
1202afaab98180a9d90b085a61ee57b2
2e031bf7fa5d80057b288c7e89125e7e
63365be1073480520dda68dac9adaf73
e25b63bfb49c3e5f306524345773394f

ZLOADER PAYLOAD URLs
hxxp://anatoliadrilling[.]com/wp-keys[.]php
hxxp://charlesengineering[.]in/wp-keys[.]php
hxxp://dcws-ev[.]com/wp-keys[.]php
hxxp://doorbhai[.]com/wp-keys[.]php

ZLOADER C2s
hxxps://rdaprint[.]in/wp-parsing[.]php
hxxps://vishweshwarastrology[.]com/wp-parsing[.]php
hxxps://statpasapipag[.]tk/wp-parsing[.]php
hxxps://www[.]netinup[.]it/wp-parsing[.]php
hxxps://www[.]oneolimpio[.]tech/wp-parsing[.]php
hxxps://hanskingrypgirigolf[.]ml/wp-parsing[.]php