2020-07-20 ZLoader IOCs

THREAT ATTRIBUTION:  ZLOADER

SUBJECTS OBSERVED
Appointment inquire letter
Followup letter to our dialogue
Information about compensated purchase # 2235
Reports you have wanted

SENDERS OBSERVED
perallasilverwheels5@aol[.]com
avebysignus@aol[.]com
c.clark92@aol[.]com
wulda_ironarrow1993y5@aol[.]com

EXCEL FILE NAMES
V[.]246[.]xls
2235rzi[.]xls
9551du[.]xls

EXCEL FILE HASHES
d361840ecbad5367afa7ee3432fb86fd
a6633b2391698adbc145273e29a71f79
a8468fb62bbcc0758eea1dcee1becc73

ZLOADER PAYLOAD URLs
hxxps://ashok-poudel[.]com[.]np/wp-keys[.]php
hxxps://atemschutzmasken-schutzmasken[.]de/wp-keys[.]php
hxxps://aulaabierta[.]agoranews[.]es/wp-keys[.]php
hxxps://ballista[.]vn/wp-keys[.]php
hxxps://bdvan[.]com/wp-keys[.]php
hxxps://bitcoincasinoreview[.]com/wp-keys[.]php

ZLOADER C2s
hxxps://33x[.]us/wp-parsing[.]php
hxxps://adealbox[.]com/wp-parsing[.]php
hxxps://aeronchairbyhermanmiller[.]com/wp-parsing[.]php
hxxps://bitvshe[.]club/wp-parsing[.]php
hxxps://bkk-wertgeschaetzt[.]de/wp-parsing[.]php
hxxps://bothigolfscuron[.]tk/wp-parsing[.]php
hxxps://buydeel[.]com/wp-parsing[.]php
hxxps://caixabanktalks-bancaprivada[.]agoranews[.]es/wp-parsing[.]php
hxxps://cardskool[.]com/wp-parsing[.]php
hxxps://cloudguchenleteli[.]gq/wp-parsing[.]php
hxxps://tiawildlidapu[.]tk/wp-parsing[.]php

SUPPORTING EVIDENCE
https://pastebin.com/raw/bb0RtM1u
https://app.any.run/tasks/3ec42809-fca8-42f9-b9c9-6bf45425e564#
https://app.any.run/tasks/735f5ec6-fb18-4c92-9d3f-bacf30a50083