Thread by @DynamicAnalysis

#ZLoader #malspam with .xls attachments.

Downloader URLs:
hxxp://merter.shop/wp-keys.php
hxxp://pasca.fapet.ub.ac.id/wp-keys.php
hxxp://pick20shop.shop/wp-keys.php
hxxp://posviat.ru/wp-keys.php

XLS sample:
app.any.run/tasks/798ee109…

#ZLoader C2s (1/2):
hxxp://draminski-retail.eu/wp-parsing.php
hxxp://duanyong.top/wp-parsing.php
hxxp://eternalstarculture.com/wp-parsing.php
hxxp://gh99.cn/wp-parsing.php
hxxps://nalighpicseracha.tk/wp-parsing.php
hxxp://glossy.vn/wp-parsing.php

#ZLoader C2s (2/2):
hxxp://jiangchi.name/wp-parsing.php
hxxps://roeslidegeralic.gq/wp-parsing.php
hxxp://mawi.io/wp-parsing.php

DLL sample:
app.any.run/tasks/db4d0953…

IOCs also posted here:
pastebin.com/Jq35F99q

cc @JAMESWT_MHT