BazarMalware
- team9
Bazar is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. Bazar reportedly has ties to TrickBot campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.From MITRE ATT&CK
Last reported 4 years ago, by Elastic Security Labs2 reports
ATT&CK techniques
6 of 17 · each with the sentence it comes from- T1053.005Scheduled Task
“… we have shown throughout the article, to execute payloads GrimAgent uses both the ShellExecute call and indirect execution through scheduled tasks.”
- T1003OS Credential Dumping
“OS Credential Dumping - LSA Secrets”
- T1003.004LSA Secrets
“OS Credential Dumping - LSA Secrets”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1036Masquerading
“Masquerading - Match Legitimate Name or Location”
- T1053Scheduled Task/Job
“Scheduled Task/Job - Scheduled Task”
What the reports say
2 reports, newest first · the exact sentence from each-
CUBA Ransomware Campaign Analysis“ZenPak is categorized as a generic Trojan which has been associated with the Bazar malware family.”
-
The Brothers Grim“…up-IB’s Threat Intelligence & Attribution system, Ryuk operators used different commodity malware over time (including Emotet, TrickBot, Bazar, Buer, and SilentNight) to deploy ransomware.”
Indicators in its reports
named in the reports above- 0f385cc69a93abea…805bdfe468a3in 1 report
- 33352a38454cfc24…8ec45b4d3d0ein 1 report
- b495456a2239f3ba…a48746e8051fin 1 report
- 159.203.70[.]39in 1 report
- hxxp://208.76.253[.]84in 1 report
- 208.76.253[.]84in 1 report
- hxxp://108.170.31[.]115/add.dllin 1 report
- 108.170.31[.]115in 1 report
- 104.217.8[.]100in 1 report
- 193.23.244[.]244in 1 report
- 86.59.21[.]38in 1 report
- 199.58.81[.]140in 1 report
- 204.13.164[.]118in 1 report
- 194.109.206[.]212in 1 report
- 131.188.40[.]189in 1 report
- 154.35.175[.]225in 1 report
- 171.25.193[.]9in 1 report
- 128.31.0[.]34in 1 report
- 128.31.0[.]39in 1 report
- scams[.]inin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.