06/24/2020: ZLoader Campaign IOCs

https://twitter.com/DynamicAnalysis/status/1275812564203638785

#ZLoader #malspam with .xls attachment from today...

Downloader URLs:
https://abdulwajed.xyz/wp-keys.php
https://bhutansyncits.com/wp-keys.php
https://anhthienquang.com/wp-keys.php
https://babysayworld.com/wp-keys.php

#ZLoader malware downloaded from:
caicultiguawa.tk

#ZLoader C2s:
https://abdulwajed.xyz/wp-parser.php
https://anhthienquang.com/wp-parser.php
https://artnego.com.tr/wp-parser.php
https://babysayworld.com/wp-parser.php
https://bhutansyncits.com/wp-parser.php
https://thebypath.com/wp-parser.php
https://infinitearc.com/wp-parser.php
https://npxrqvwocrpecygjnclw.com/post.php

XLS sample:
https://app.any.run/tasks/50b2d538-e337-4577-8d2a-ffe34ca9d157/