06/23/2020: ZLoader Campaign IOCs

https://twitter.com/DynamicAnalysis/status/1275454686540132352

#ZLoader malspam from 06/23/2020 contains a .xls attachment.

Downloader URLs:
https://magic-place.fr/wp-crunch.php
https://velocitii.com/wp-crunch.php
https://hongsamlinhchi.vn/wp-crunch.php
https://esoseraz.cf/wp-crunch.php

#ZLoader downloaded from:
camnighwertmu.cf

#ZLoader C2s:
https://blacalypichab.ga/wp-parsing.php
https://stalaleninmac.tk/wp-parsing.php
https://thepsaokhue.com/wp-parsing.php
https://metagro.com.br/wp-parsing.php
https://yqm5.cn/wp-parsing.php
https://skwifi.net/wp-parsing.php

XLS sample:
https://app.any.run/tasks/010322f7-f7f4-4c96-abc8-8bab53ced9ea