2020-08-10 ZLoader IOCs

SUBJECTS OBSERVED
Full summary of the Invoice # 5353
Full summary of the Invoice No. 3710
You have Incoming Invoice

SENDERS OBSERVED
aelfthoefpuing11@aol[.]com
gunwise_prancingtroll@aol[.]com
robertsnancy53@aol[.]com

EXCEL FILE NAMES
Hi3710[.]xls
Jea_5353.xls
Wu[.]1307[.]xls

EXCEL FILE HASHES
60cc345e6c801d5904a0d8efdcfa0e0d
3cc7496563da3abd4138fd0cda44a30b

ZLOADER PAYLOAD URLs
hxxps://chiarizzimooca-lancamento[.]com[.]br/wp-keys[.]php
hxxps://danyalpakhsh[.]ir/wp-keys[.]php
hxxps://flidot[.]com/wp-keys[.]php
hxxps://globalfilipino[.]net/wp-keys[.]php

ZLOADER C2s
hxxps://ahoeviwo[.]com/wp-parsing[.]php
hxxps://cga[.]cn/wp-parsing[.]php
hxxps://chiarizzimooca-lancamento[.]com[.]br/wp-parsing[.]php
hxxps://danyalpakhsh[.]ir/wp-parsing[.]php
hxxps://flidot[.]com/wp-parsing[.]php
hxxps://geoflamonadrieve[.]tk/wp-parsing[.]php
hxxps://globalfilipino[.]net/wp-parsing[.]php
hxxps://mementomori[.]vn/wp-parsing[.]php
hxxps://metodoking[.]com/wp-parsing[.]php
hxxps://nocusnanakindtu[.]tk/wp-parsing[.]php