Discover and read the best of Twitter Threads about #ZLoader
Most recents (2)
#ZLoader #malspam with .xls attachments.
Downloader URLs:
hxxp://merter.shop/wp-keys.php
hxxp://pasca.fapet.ub.ac.id/wp-keys.php
hxxp://pick20shop.shop/wp-keys.php
hxxp://posviat.ru/wp-keys.php
XLS sample:
app.any.run/tasks/798ee109…
Downloader URLs:
hxxp://merter.shop/wp-keys.php
hxxp://pasca.fapet.ub.ac.id/wp-keys.php
hxxp://pick20shop.shop/wp-keys.php
hxxp://posviat.ru/wp-keys.php
XLS sample:
app.any.run/tasks/798ee109…
#ZLoader C2s (1/2):
hxxp://draminski-retail.eu/wp-parsing.php
hxxp://duanyong.top/wp-parsing.php
hxxp://eternalstarculture.com/wp-parsing.php
hxxp://gh99.cn/wp-parsing.php
hxxps://nalighpicseracha.tk/wp-parsing.php
hxxp://glossy.vn/wp-parsing.php
hxxp://draminski-retail.eu/wp-parsing.php
hxxp://duanyong.top/wp-parsing.php
hxxp://eternalstarculture.com/wp-parsing.php
hxxp://gh99.cn/wp-parsing.php
hxxps://nalighpicseracha.tk/wp-parsing.php
hxxp://glossy.vn/wp-parsing.php
#ZLoader C2s (2/2):
hxxp://jiangchi.name/wp-parsing.php
hxxps://roeslidegeralic.gq/wp-parsing.php
hxxp://mawi.io/wp-parsing.php
DLL sample:
app.any.run/tasks/db4d0953…
IOCs also posted here:
pastebin.com/Jq35F99q
cc @JAMESWT_MHT
hxxp://jiangchi.name/wp-parsing.php
hxxps://roeslidegeralic.gq/wp-parsing.php
hxxp://mawi.io/wp-parsing.php
DLL sample:
app.any.run/tasks/db4d0953…
IOCs also posted here:
pastebin.com/Jq35F99q
cc @JAMESWT_MHT
#ZLoader #malspam campaign with .xls attachments:
app.any.run/tasks/b58e610b…
Downloader URLs:
s://wireborg.com/wp-keys.php
p://zmedia.shwetech.com/wp-keys.php
s://datalibacbi.ml/wp-keys.php
s://procacardenla.ga/wp-keys.php
Redirect to DLL located at:
gueberzehngemoonde[.]tk
app.any.run/tasks/b58e610b…
Downloader URLs:
s://wireborg.com/wp-keys.php
p://zmedia.shwetech.com/wp-keys.php
s://datalibacbi.ml/wp-keys.php
s://procacardenla.ga/wp-keys.php
Redirect to DLL located at:
gueberzehngemoonde[.]tk
#ZLoader C2s:
s://neomithirdseman.tk/wp-parsing.php
s://fernmasucsavidi.cf/wp-parsing.php
s://wireborg.com/wp-parsing.php
s://secretele-naturii.xyz/wp-parsing.php
s://legendcoder.com/wp-parsing.php
s://tiilearaphefanpa.gq/wp-parsing.php
s://sutoverlaopers.tk/wp-parsing.php
s://neomithirdseman.tk/wp-parsing.php
s://fernmasucsavidi.cf/wp-parsing.php
s://wireborg.com/wp-parsing.php
s://secretele-naturii.xyz/wp-parsing.php
s://legendcoder.com/wp-parsing.php
s://tiilearaphefanpa.gq/wp-parsing.php
s://sutoverlaopers.tk/wp-parsing.php
