06/25/2020: ZLoader Campaign IOCs

https://twitter.com/DynamicAnalysis/status/1276181049857454081

#ZLoader #malspam for today with .xls attachments.

Downloader URLs:
https://estudiolacazezancarini.com/wp-crunch.php
https://germdisruptor.com/wp-crunch.php
https://gurukal.in/wp-crunch.php
https://indoeducation.com/wp-crunch.php

DLL downloaded from:
healthhuthlasu.cf

#ZLoader C2s:
https://bilaalsblog.com/wp-parsing.php
https://cotentialgroup.com/wp-parsing.php
https://danielamartinezs.com/wp-parsing.php
https://ddtwo.mirdamadsch.ir/wp-parsing.php
https://sunctheedersga.cf/wp-parsing.php
https://titeboucaltiatin.tk/wp-parsing.php

XLS sample:
https://app.any.run/tasks/ae29c0ad-74e9-4552-97d0-a9584f8be6e1#

DLL Sample:
https://app.any.run/tasks/9362d583-ab76-4091-9cd4-f1d1adc8dedd