2020-07-15 ZLoader IOCs

THREAT ATTRIBUTION:  ZLOADER

SUBJECTS OBSERVED
A warm hint that I never receive your reaction still
Contract  809 info
Full summary of the Invoice id 482
Given invoice clarification
Paperwork that you can review
Paperwork you have asked for
Receipt important information - ID # 625
The proposal tip

SENDERS OBSERVED
bampbanerignus11@aol[.]com
basur_edradriemire@aol[.]com
cenberttruink1967@aol[.]com
edwinepoourk1986x@aol[.]com
leemary234@aol[.]com
osonelimerodecan11l@aol[.]com
pehtherehoodish2@aol[.]com
robertslisa917@aol[.]com

EXCEL FILE NAMES
764[.]xls
att[.]xls
BHK-543[.]xls
BO625[.]xls
inf[.]xls
WLR[.]809[.]xls
work[.]xls

EXCEL FILE HASHES
154097bca6632db44faa4a198d2eb58e
34356f7a005696baa293c321d346d979
467262ca59bb3c552775ec7dd256823a
7980c9c41ae19ac8678104ade5df1e86
866898bb8429b8fa0db31fa9937ed075
d95015f6a443d81df694c80853f93f8f
e140c4a6bbbb058e08c2b81fc4216742

ZLOADER PAYLOAD URLs
hxxps://quuik[.]com/wp-keys[.]php
hxxps://theincrediblebihar[.]com/wp-keys[.]php
hxxps://tlcid[.]org/wp-keys[.]php
hxxps://tvxnoticias[.]com/wp-keys[.]php

ZLOADER C2s
hxxps://chwasinsvolanrosti[.]gq/wp-parsing[.]php
hxxps://epaweb[.]cl/wp-parsing[.]php
hxxps://mediavision[.]se/wp-parsing[.]php
hxxps://minkumarsapkota[.]com[.]np/wp-parsing[.]php
hxxps://modernchina[.]org/wp-parsing[.]php
hxxps://newwavechairco[.]com/wp-parsing[.]php
hxxps://noithatnhathoang[.]vn/wp-parsing[.]php
hxxps://stanapabserdoni[.]tk/wp-parsing[.]php

SUPPORTING EVIDENCE
https://pastebin.com/k1VcQ33c
https://app.any.run/tasks/4b351baf-4476-47f9-afbc-6faba28f0fad
https://app.any.run/tasks/adfb6cba-3189-4836-aab6-db388360d766