Bazarloader

Malware updated 4 months ago (2024-05-04T20:19:39.203Z)

Download STIX

Preview STIX

BazarLoader is a form of malware that has been utilized extensively by ITG23, a cybercriminal group. This harmful software infiltrates systems via suspicious downloads, emails, or websites, potentially stealing personal information, disrupting operations, or holding data for ransom. ITG23 has used BazarLoader in conjunction with other malware types such as Trickbot and Conti, crypting these malicious programs to exploit systems further. Other groups such as IcedID and Emotet have also been observed using these crypters. The malware has been associated with payloads within Emotet, Trickbot, IcedID, Conti, and Cobalt Strike, demonstrating its wide-ranging application. The distribution of BazarLoader has been facilitated through various vulnerabilities and platforms. For instance, the AppX Installer spoofing vulnerability was exploited to distribute BazarLoader using malicious packages hosted on Microsoft Azure. The malware was delivered via URLs ending in *.web.core.windows.net. Additionally, BazarLoader and Trickbot deliveries were often followed by ransomware attacks, including those involving Conti. In fact, an increase in Trickbot and BazarLoader deliveries since June 2021 corresponded to a surge in Conti ransomware attacks during the summer. ITG23 has adapted to the ransomware economy by creating the Conti ransomware-as-a-service (RaaS) and using its BazarLoader and Trickbot payloads to establish a foothold for ransomware attacks. BazarLoader samples have been observed downloading Trickbot, suggesting that access achieved through these campaigns could be used to initiate a ransomware attack. In certain instances, clicking on a link downloads a ZIP archive containing a malicious JScript downloader. This script contacts a URL on newly created domains to download BazarLoader, which subsequently downloads Cobalt Strike and a PowerShell script to exploit the PrintNightmare vulnerability.

Description last updated: 2024-05-04T19:52:59.570Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
IcedID	3	IcedID is a malicious software (malware) that has been linked to various cybercrime operations. The malware can infiltrate systems via suspicious downloads, emails, or websites and proceed to steal personal information, disrupt operations, or hold data for ransom. IcedID has been associated with oth
Bazarbackdoor	2	BazarBackdoor is a type of malware developed by ITG23, first identified in April 2020. It is commonly distributed via contact forms on corporate websites, bypassing regular phishing emails, which makes it harder to detect. The malware is often associated with BazarLoader, both of which were used ext

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Ransomware

Malware

Exploit

Cobalt Strike

Payload

Extortion

Backdoor

Loader

RaaS

Vulnerability

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

ID	Type	Votes	Profile Description
TrickBot	Unspecified	4	TrickBot is a notorious malware that has been used extensively by cybercriminals to exploit and damage computer systems. It operates as a crimeware-as-a-service platform, infecting systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can stea
Conti	Unspecified	4	Conti is a notorious malware and ransomware operation that has caused significant damage to computer systems worldwide. The Conti group, believed to have around 200 employees, operated like a regular business, with internal communications revealing the organization's structure and operations. It was
Emotet	Unspecified	4	Emotet is a highly dangerous and insidious type of malware that has been active, particularly during recent summers. It is distributed primarily through documents attached to emails, using conversations found in compromised accounts. Once an unsuspecting user clicks either the enable button or an im
Bumblebee	Unspecified	3	Bumblebee is a type of malware that has been linked to ITG23, a cybercriminal group known for its use of crypters such as Emotet, IcedID, Qakbot, Bumblebee, and Gozi. Distributed via phishing campaigns or compromised websites, Bumblebee enables the delivery and execution of further payloads. The sam
Diavol	Unspecified	3	Diavol is a type of malware, specifically ransomware, that infiltrates systems to exploit and cause damage. It can infect systems through various channels such as suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, Diavol can steal personal information, disrupt ope
Ryuk	Unspecified	2	Ryuk is a type of malware known as ransomware, which has been utilized by the threat group ITG23 for several years. This group has been notorious for crypting their malware, with crypters seen in use with other malware such as Trickbot, Emotet, Cobalt Strike, and Ryuk. In 2019, most ransomware inves
QakBot	Unspecified	2	Qakbot is a type of malware that has been linked to various cybercriminal activities, with its presence first observed as early as 2020. It gained notoriety for its role in the operations of the Black Basta ransomware group, which used Qakbot extensively in sophisticated phishing campaigns. The malw

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

ID	Type	Votes	Profile Description
ITG23	Unspecified	2	ITG23, also known as the Trickbot/Conti syndicate, is a significant threat actor that has been active since 2016 in the East European cybercrime arena. This group is renowned for its use of Reflective DLL Injection code in many of its crypters, with the presence of these crypters on a file sample be

Source Document References

Information about the Bazarloader Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
CERT-EU	8 months ago	Microsoft disables MSIX protocol handler abused in malware attacks
MITRE	9 months ago	Trickbot Rising — Gang Doubles Down on Infection Efforts to Amass Network Footholds
SecurityIntelligence.com	10 months ago	ITG23 Crypters Highlight Cooperation Between Cybercriminal Groups
CERT-EU	a year ago	Bumblebee Malware Abuses WebDAV Protocol to Attack Organizations
BankInfoSecurity	a year ago	Cybercrime Tremors: Experts Forecast Qakbot Resurgence
Flashpoint	a year ago	Qakbot Takedown: A Brief Victory in the Fight Against Resilient Malware
MITRE	2 years ago	Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser \| Mandiant
BankInfoSecurity	a year ago	Stung by Free Decryptor, Ransomware Group Embraces Extortion
MITRE	2 years ago	Wizard Spider Modifies and Expands Toolset [Adversary Update]
MITRE	2 years ago	Ransomware Activity Targeting the Healthcare and Public Health Sector \| CISA
MITRE	2 years ago	SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot
CERT-EU	a year ago	Cyber security week in review: April 28, 2023
CERT-EU	a year ago	Analysis of Ransomware Attack Timelines \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware – National Cyber Security Consulting
MITRE	2 years ago	Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem
MITRE	2 years ago	CONTInuing the Bazar Ransomware Story
CERT-EU	2 years ago	UK cracks down on ransomware actors \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware - National Cyber Security
CERT-EU	a year ago	New strain of JavaScript dropper delivers Bumblebee and IcedID malware
SecurityIntelligence.com	a year ago	The Trickbot/Conti Crypters: Where Are They Now?
CERT-EU	2 years ago	No Ransomware Please, We're British \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware - National Cyber Security
MITRE	2 years ago	A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak