07/20/2020: ZLoader Campaign IOCs

https://twitter.com/DynamicAnalysis/status/1285264183328673792

#ZLoader #malspam with .xls attachments.

Downloader URLs:
hxxps://bdvan.com/wp-keys.php
hxxps://atemschutzmasken-schutzmasken.de/wp-keys.php
hxxps://bitcoincasinoreview.com/wp-keys.php
hxxps://ballista.vn/wp-keys.php

C2s:
https://33x.us/wp-parsing.php
https://adealbox.com/wp-parsing.php
https://aeronchairbyhermanmiller.com/wp-parsing.php
https://bitvshe.club/wp-parsing.php
https://bkk-wertgeschaetzt.de/wp-parsing.php
https://buydeel.com/wp-parsing.php
https://bothigolfscuron.tk/wp-parsing.php
https://caixabanktalks-bancaprivada.agoranews.es/wp-parsing.php
https://cardskool.com/wp-parsing.php
https://cloudguchenleteli.gq/wp-parsing.php

.xls sample:
https://app.any.run/tasks/3ec42809-fca8-42f9-b9c9-6bf45425e564#

.dll sample:
https://app.any.run/tasks/735f5ec6-fb18-4c92-9d3f-bacf30a50083
_____________________________________________________________________

Here is another .xls sample with a couple different downloader URLs:

https://ashok-poudel.com.np/wp-keys.php
https://atemschutzmasken-schutzmasken.de/wp-keys.php
https://aulaabierta.agoranews.es/wp-keys.php
https://ballista.vn/wp-keys.php

.xls sample:
https://app.any.run/tasks/f7878778-1305-4eb6-9215-f6f7acac4e85#
_____________________________________________________________________

Additional information from @JasonMilletary (https://twitter.com/JasonMilletary/status/1285295845601087488)

Looks like they upgraded the minor version number from 1.3.27.0 to 1.4.27.0.

Also an additional C2 URL that gets added:
https://tiawildlidapu.tk/wp-parsing.php