Discover and read the best of Twitter Threads about #ZLoader

Most recents (2)

#ZLoader #malspam with .xls attachments.

Downloader URLs:
hxxp://merter.shop/wp-keys.php
hxxp://pasca.fapet.ub.ac.id/wp-keys.php
hxxp://pick20shop.shop/wp-keys.php
hxxp://posviat.ru/wp-keys.php

XLS sample:
app.any.run/tasks/798ee109…
#ZLoader C2s (1/2):
hxxp://draminski-retail.eu/wp-parsing.php
hxxp://duanyong.top/wp-parsing.php
hxxp://eternalstarculture.com/wp-parsing.php
hxxp://gh99.cn/wp-parsing.php
hxxps://nalighpicseracha.tk/wp-parsing.php
hxxp://glossy.vn/wp-parsing.php
#ZLoader C2s (2/2):
hxxp://jiangchi.name/wp-parsing.php
hxxps://roeslidegeralic.gq/wp-parsing.php
hxxp://mawi.io/wp-parsing.php

DLL sample:
app.any.run/tasks/db4d0953…

IOCs also posted here:
pastebin.com/Jq35F99q

cc @JAMESWT_MHT
Read 3 tweets
#ZLoader #malspam campaign with .xls attachments:

app.any.run/tasks/b58e610b…

Downloader URLs:

s://wireborg.com/wp-keys.php
p://zmedia.shwetech.com/wp-keys.php
s://datalibacbi.ml/wp-keys.php
s://procacardenla.ga/wp-keys.php

Redirect to DLL located at:

gueberzehngemoonde[.]tk
#ZLoader C2s:

s://neomithirdseman.tk/wp-parsing.php
s://fernmasucsavidi.cf/wp-parsing.php
s://wireborg.com/wp-parsing.php
s://secretele-naturii.xyz/wp-parsing.php
s://legendcoder.com/wp-parsing.php
s://tiilearaphefanpa.gq/wp-parsing.php
s://sutoverlaopers.tk/wp-parsing.php
#ZLoader IOCs also listed here:
pastebin.com/TutiU3FW
Read 3 tweets

Related hashtags

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!