06/29/2020: ZLoader Campaign IOCs

https://twitter.com/DynamicAnalysis/status/1277663483958644737

#ZLoader #malspam from 06/29/2020. XLS sample found here:

https://bazaar.abuse.ch/sample/d5d16707065d2d2a04412f9edb7771ee119d82751b60ce1902bf0f8a53c8b89f/

.xls downloader URLs:
https://helpdallas.org/wp-crunch.php
https://designerremodeling.com/wp-crunch.php
https://healsoul.thememove.com/wp-crunch.php
https://septatechnology.com/wp-crunch.php

#ZLoader payload located at:
https://celvadesynola.gq/34rt134.php

#ZLoader C2s:
https://krazycupmunchiesbar.com/wp-parsing.php
https://memobhurinquipres.tk/wp-parsing.php
https://megaklima.com/wp-parsing.php
https://thefinejeweller.com/wp-parsing.php
https://thisismushu.com/wp-parsing.php
https://goarisentopdbemas.tk/wp-parsing.php