Thread by @DynamicAnalysis

#ZLoader #malspam campaign with .xls attachments:

app.any.run/tasks/b58e610b…

Downloader URLs:

s://wireborg.com/wp-keys.php
p://zmedia.shwetech.com/wp-keys.php
s://datalibacbi.ml/wp-keys.php
s://procacardenla.ga/wp-keys.php

Redirect to DLL located at:

gueberzehngemoonde[.]tk

#ZLoader C2s:

s://neomithirdseman.tk/wp-parsing.php
s://fernmasucsavidi.cf/wp-parsing.php
s://wireborg.com/wp-parsing.php
s://secretele-naturii.xyz/wp-parsing.php
s://legendcoder.com/wp-parsing.php
s://tiilearaphefanpa.gq/wp-parsing.php
s://sutoverlaopers.tk/wp-parsing.php

#ZLoader IOCs also listed here:
pastebin.com/TutiU3FW