BazarBackdoorMalware
- bazarloader
- beerbot
- team9backdoor
BazarBackdoor is a small backdoor, probably by a TrickBot "spin-off" like anchor. Its called team9 backdoor (and the corresponding loader: team9 restart loader). For now, it exclusively uses Emercoin domains (.bazar), thus the naming. FireEye uses KEGTAP as name for BazarLoader and BEERBOT for BazarBackdoor.From MISP Galaxy
Last reported 4 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 16 · each with the sentence it comes from- T1003OS Credential Dumping
“OS Credential Dumping - LSA Secrets”
- T1003.004LSA Secrets
“OS Credential Dumping - LSA Secrets”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1036Masquerading
“Masquerading - Match Legitimate Name or Location”
- T1053Scheduled Task/Job
“Scheduled Task/Job - Scheduled Task”
- T1053.005Scheduled Task
“To ensure that Defender Control continued to run, the threat actor used svchost.exe to create a scheduled task.”
What the reports say
1 report, newest first · the exact sentence from each-
CUBA Ransomware Campaign Analysis“The BazarBackdoor has a long history and was recently sighted in ransomware-as-a-service campaigns.”
Indicators in its reports
named in the reports above- 0f385cc69a93abea…805bdfe468a3in 1 report
- 33352a38454cfc24…8ec45b4d3d0ein 1 report
- b495456a2239f3ba…a48746e8051fin 1 report
- 159.203.70[.]39in 1 report
- hxxp://208.76.253[.]84in 1 report
- 208.76.253[.]84in 1 report
- hxxp://108.170.31[.]115/add.dllin 1 report
- 108.170.31[.]115in 1 report
- 104.217.8[.]100in 1 report
- 193.23.244[.]244in 1 report
- 86.59.21[.]38in 1 report
- 199.58.81[.]140in 1 report
- 204.13.164[.]118in 1 report
- 194.109.206[.]212in 1 report
- 131.188.40[.]189in 1 report
- 154.35.175[.]225in 1 report
- 171.25.193[.]9in 1 report
- 128.31.0[.]34in 1 report
- 128.31.0[.]39in 1 report
- scams[.]inin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.