06/18/2020: ZLoader Campaign IOCs

https://twitter.com/DynamicAnalysis/status/1273673818654064640

#ZLoader #malspam campaign with .xls attachments:

https://app.any.run/tasks/b58e610b-817e-4dd9-aa8b-45791c8d5f6c

Downloader URLs:

https://wireborg.com/wp-keys.php
http://zmedia.shwetech.com/wp-keys.php
https://datalibacbi.ml/wp-keys.php
https://procacardenla.ga/wp-keys.php

Redirect to DLL located at:

https://gueberzehngemoonde.tk/rqh3h51.php

#ZLoader C2s:

https://neomithirdseman.tk/wp-parsing.php
https://fernmasucsavidi.cf/wp-parsing.php
https://wireborg.com/wp-parsing.php
https://secretele-naturii.xyz/wp-parsing.php
https://legendcoder.com/wp-parsing.php
https://tiilearaphefanpa.gq/wp-parsing.php
https://sutoverlaopers.tk/wp-parsing.php

A DLL sample that was submitted to AnyRun by @luigi_martire94 (https://twitter.com/luigi_martire94/status/1273687602747584520):
https://app.any.run/tasks/e24f7fab-12ae-4f06-8748-0ea3e9ab21a6/

Information about the sample collected by @ThreatHive (https://twitter.com/ThreatHive/status/1273691021935890432):
"marker": "18/06",
"botnet": "minik",
"rc4_key": "dh8f3@3hdf#hsf23"