07/06/2020: ZLoader Campaign IOCs

https://twitter.com/DynamicAnalysis/status/1280177168048406528

#ZLoader #malspam from today with .xls attachments.

#ZLoader downloader URLs:
https://celltee.xyz/wp-keys.php
https://dkf.co.id/wp-keys.php
https://electricpicklemiami.com/wp-keys.php
https://elito-grad.ru/wp-keys.php

#ZLoader C2s:
https://acrilicossp.com.br/wp-parsing.php
https://neterscunverssuf.gq/wp-parsing.php
https://afdah2.com/wp-parsing.php
https://ajacademys.com/wp-parsing.php
https://aydninsaat.com/wp-parsing.php
https://bludelego.it/wp-parsing.php
https://chwasinsvolanrosti.gq/wp-parsing.php
https://bnegg.vn/wp-parsing.php

XLS sample:
https://app.any.run/tasks/2187384f-6461-4c2d-b2c2-f4fcd57e86f5#

#ZLoader DLLs:
https://urlhaus.abuse.ch/url/408282/