S0534 - Bazar

Bazar is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. Bazar reportedly has ties to TrickBot campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.

Author
agomez
Created
2023-06-14 00:33:36
Last updated
2026-02-07 19:01:39
Downloads
319068
IPv4 indicators
9
Hostname indicators
1
URL indicators
2
Sample indicators
130

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

162.33.178.248 IPv4

modified 2026-10-14 23:08:50
ET CNC Feodo Tracker Reported CnC Server UDP (Emerging Threats) · ET CNC Feodo Tracker Reported CnC Server TCP (Emerging Threats) · BazarBackdoor (ThreatFox Abuse.ch) · Evilginx (ThreatFox Abuse.ch)

jaffacakes118_Virus.Win32.Sality.gen.cfb831b33ae69a25739a3 Sample

modified 2026-10-14 12:47:16
Bazaloader (Triage)

jaffacakes118_HEUR.Trojan.Win32.Generic.1b886e5d275afe9aec1fa4e0f4669ae9 Sample

modified 2026-10-13 23:33:01
Bazaloader (Triage)

2026-10-11_40e04462ef344f9eff4dd33112db660b_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-12 23:29:48
Bazarloader (Triage)

2026-10-11_8d3d642394238559642cedd2aa3f78c5_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-12 16:23:53
Bazarloader (Triage)

2026-10-11_a9c2c9e9311a7d63a913d2690e77845d_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-12 13:46:04
Bazarloader (Triage)

2026-10-11_eafcf555115cc3dcfec61a91782f1d43_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-12 02:27:56
Bazarloader (Triage)

Documents.lnk Sample

modified 2026-10-12 01:20:47
BazaLoader (MalwareBazaar Abuse.ch) · BazaLoader (Abuse.ch)

jaffacakes118_Virus.Win32.Sality.gen.fc01f5f91a17453387e45 Sample

modified 2026-10-10 14:45:26
Bazaloader (Triage)

5b6a96d9b85a18b6cc77d6c2bc59d067f84f2e0448cc13bf14a7fd3c5f95bf93.dll Sample

modified 2026-10-09 07:18:27
BazaLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

194.40.243.33 IPv4

modified 2026-10-09 07:18:27
ET CNC Feodo Tracker Reported CnC Server UDP (Emerging Threats) · ET CNC Feodo Tracker Reported CnC Server TCP (Emerging Threats) · BazarLoader (FeodoTracker Abuse.ch) · BazarBackdoor (ThreatFox Abuse.ch) · Mail Spammer (Barracuda)

bd00466c3fe525a8fb5d13cc9d18e336.dll Sample

modified 2026-10-09 07:18:26
BazaLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

45.14.226.23 IPv4

modified 2026-10-09 07:18:26
BazarLoader (FeodoTracker Abuse.ch) · Mail Spammer (Barracuda)

142.11.237.178 IPv4

modified 2026-10-09 07:18:08
ET CNC Feodo Tracker Reported CnC Server UDP (Emerging Threats) · ET CNC Feodo Tracker Reported CnC Server TCP (Emerging Threats) · BazarLoader (FeodoTracker Abuse.ch) · Mail Spammer (Barracuda)

45.15.131.126 IPv4

modified 2026-10-09 07:18:07
BazarLoader (FeodoTracker Abuse.ch) · Mail Spammer (Barracuda)

146.19.253.90 IPv4

modified 2026-10-09 07:18:04
ET CNC Feodo Tracker Reported CnC Server UDP (Emerging Threats) · ET CNC Feodo Tracker Reported CnC Server TCP (Emerging Threats) · BazarLoader (FeodoTracker Abuse.ch) · Mail Spammer (Barracuda)

45.41.204.137 IPv4

modified 2026-10-09 07:18:03
BazarLoader (FeodoTracker Abuse.ch) · Mail Spammer (Barracuda)

5.2.78.37 IPv4

modified 2026-10-09 07:18:03
BazarLoader (FeodoTracker Abuse.ch) · Mail Spammer (Barracuda)

de307ecbfecca217a680cdee9e11f367b6b2f95e06c909d1aa0ef209f228ff63 Sample

modified 2026-10-09 00:53:40
Generic.Malware (Abuse.ch) · BazaLoader (Abuse.ch)

e6f0206d99bc279a062e055582e2c452500d7067968e9de186d7d78ed158271d Sample

modified 2026-10-09 00:13:45
BazaLoader (Abuse.ch) · Generic.Malware (Abuse.ch)

f266bc35f9a52d2dc6e63fab03f8a6aab989639b9920e2afe5d2d4517340d3c9 Sample

modified 2026-10-08 23:26:06
BazaLoader (Abuse.ch)

2026-10-05_21633a966020f0452fdd1e00e24c0b64_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-07 04:41:20
Bazarloader (Triage)

2026-10-05_a9d5fdfb3fe05994b4ded8d5720c7433_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-06 17:32:33
Bazarloader (Triage)

2026-10-06_65ba910667af569c8c77a1c8e2f68957_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-06 12:51:09
Bazarloader (Triage)

bcccb14658e8c1bee8107a2c314957c2bd9e505e73012b0aaa18df9fedf99248 Sample

modified 2026-10-06 10:49:23
AD.Bazar (Hybrid-Analysis)

2026-10-06_a48d29884c6ae75a5e86fc2408739d28_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-06 10:42:02
Bazarloader (Triage)

2026-10-05_e880611225bee5d4ba9a6dae3d6c2801_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-06 02:51:07
Bazarloader (Triage)

2026-10-03_e0403410a69f5873abfc2c570e37b7ad_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-05 23:16:45
Bazarloader (Triage)

2026-10-03_48f71395ca311b7404d444fd35b0b8ff_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-04 13:24:00
Bazarloader (Triage)

2026-10-03_61039211b189be581881b80b15418d58_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-04 11:18:03
Bazarloader (Triage)

fe88142ad213aeed2dfbe7509913c8a160cb90b19dc2b5c535f15d875ebd51fb.exe Sample

modified 2026-10-04 01:09:38
BazaLoader (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

2026-09-30_12521e11de62d8dcaf17c070ca410df9_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-01 18:36:04
Bazarloader (Triage)

2026-09-30_df3a0872ece1132b7034c55eabf68897_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-01 04:25:10
Bazarloader (Triage)

2026-09-30_ef16f386e3f85286cc93dd16dc2b724c_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-10-01 02:45:33
Bazarloader (Triage)

164.90.226.23 IPv4

modified 2026-09-30 10:14:26
BazarBackdoor (ThreatFox Abuse.ch) · Malicious Host (CIArmy) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · ET CINS Active Threat Intelligence Poor Reputation IP UDP (Emerging Threats)

2026-09-29_550cac159b57224ed384931db9fae8fc_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-09-30 00:52:05
Bazarloader (Triage)

2026-09-29_7c2a890f6441013395c1cadf29a87ada_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-09-29 21:47:10
Bazarloader (Triage)

2026-09-29_c188f9bedc4f8ab28b489ce1301b3907_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-09-29 17:16:13
Bazarloader (Triage)

2026-09-29_c62c64e8f8edb5bf02a5d6b999f1e45f_cobalt-strike_icedid_njrat_satacom_vidar Sample

modified 2026-09-29 16:56:39
Bazarloader (Triage)

sub_8236b4c91e12.bin Sample

modified 2026-09-29 11:55:42
Gen:Variant.Mikey (Hybrid-Analysis) · BazaLoader (MalwareBazaar Abuse.ch) · Bazar (Triage)

2026-09-24_8bd41a6f05e4d628ab720cc0ecff294b_conti_elex Sample

modified 2026-09-25 05:15:40
Bazarloader (Triage)

jaffacakes118_virussign.com_f880380e0b7045c4af9836affe209030.vir Sample

modified 2026-09-17 12:49:11
Bazaloader (Triage)

jaffacakes118_899e4e5fb96534c7f044ee4da53aa710_NeikiAnalytics.exe Sample

modified 2026-09-17 12:47:26
Bazaloader (Triage)

jaffacakes118_07fda1d334bea957501bc0df9d8361e0_NeikiAnalytics.exe Sample

modified 2026-09-17 12:46:51
Bazaloader (Triage)

a49d28798147cc039e3ac341044fe612.dll Sample

modified 2026-09-11 02:24:31
BazaLoader (Abuse.ch)

01fb98c5b81fa6886f937fe56f82f366.dll Sample

modified 2026-09-11 02:24:15
BazaLoader (MalwareBazaar Abuse.ch)

81cb0a31bb453ec6d1ad01dd48af8f2e.dll Sample

modified 2026-09-11 02:24:14
BazaLoader (MalwareBazaar Abuse.ch)

cf9d9aa2a35ea5f159916210cd9ecb77.dll Sample

modified 2026-09-11 02:24:13
BazaLoader (MalwareBazaar Abuse.ch)

c5dc5fd676ab5b877bc86f88485c29d9f74933f8e98a33bddc29f0f3acc5a5b9 Sample

modified 2026-09-08 20:45:06
BazaLoader (MalwareBazaar Abuse.ch) · LazarLoader (ThreatFox Abuse.ch) · Generic Malware (Hybrid-Analysis)

DragTest.dll Sample

modified 2026-09-06 00:57:41
BazaLoader (Abuse.ch) · Generic.Malware (Abuse.ch)

1d921a846347be4c8cefbbf0449a40710408ecccf5cbbf99a0f8e41acb78881e Sample

modified 2026-09-06 00:54:13
Malware.Generic (Hybrid-Analysis) · BazaLoader (Abuse.ch)

78991ae2911d410f367535fc91d1c986.dll Sample

modified 2026-09-03 02:25:38
BazaLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

f479a0b3c07a701127b732968a321645.dll Sample

modified 2026-09-03 01:39:20
Generic.Malware (Abuse.ch) · BazaLoader (Abuse.ch)

SharedFiles.dll Sample

modified 2026-08-30 01:54:28
BazaLoader (Abuse.ch) · Generic.Malware (Abuse.ch)

Documents.lnk Sample

modified 2026-08-27 20:07:15
BazaLoader (Abuse.ch) · Generic.Malware (Abuse.ch)

0x0005000000012636-65.exe Sample

modified 2026-08-24 07:14:31
BazaLoader (Abuse.ch) · Generic.Malware (Abuse.ch)

Insurance_template.rtf Sample

modified 2026-08-24 07:14:31
BazaLoader (Abuse.ch) · Generic.Malware (Abuse.ch)

215e0accdf538d48a8a7bf79009e8f9b.dll Sample

modified 2026-08-01 19:19:44
BazaLoader (Abuse.ch)

a989a70066d734762a1ec5255604c197.dll Sample

modified 2026-08-01 01:51:13
BazaLoader (Abuse.ch)

2026-06-04_6caaeef74d8a3ec9c3c150a114c9d172_amadey_darkgate_elex_emotet_icedid_luca-stealer_njrat_remcos_wannacry Sample

modified 2026-07-18 00:58:11
Bazar (Triage)

JavaObjectReflectiveB.dll Sample

modified 2026-07-09 04:59:34
BazaLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

docs1549.hta Sample

modified 2026-06-28 02:25:31
BazaLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

3e61dd5bcec1efd3b357c1ca4b8aac54 Sample

modified 2026-06-18 21:01:07
BazaLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

dr_2557993_.zip Sample

modified 2026-06-16 04:06:24
BazaLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

particulars_09.20.2021.doc Sample

modified 2026-06-15 21:07:39
Generic.Malware (Abuse.ch) · BazaLoader (Abuse.ch)

2026-06-01_90d8ff3e5d641f8f1c43879ca00fde27_coinminer_icedid_njrat_remcos Sample

modified 2026-06-01 01:22:44
Bazar (Triage)

JavaObjectReflectiveW.dll Sample

modified 2026-05-31 01:05:50
BazaLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

1.dll Sample

modified 2026-05-30 11:34:43
BazaLoader (Abuse.ch)

85f6edaa9fcf9646a82acef0fdf9873c Sample

modified 2026-05-28 04:03:36
BazaLoader (MalwareBazaar Abuse.ch)

bd4953dbce803a724515c75235cd92c0 Sample

modified 2026-05-28 03:13:36
BazaLoader (MalwareBazaar Abuse.ch)

2d6660d8414b5039f08cc2b5677e8b6f Sample

modified 2026-05-27 20:34:15
BazaLoader (MalwareBazaar Abuse.ch)

sub_9b7bdb4cb71e.bin Sample

modified 2026-05-24 02:01:46
BazaLoader (MalwareBazaar Abuse.ch) · LazarLoader (ThreatFox Abuse.ch) · Bruteratel (Triage)

sub_05d2a38294d8.bin Sample

modified 2026-05-24 01:30:28
Bazar (Triage)

a7b5773f21c69c8e2706df0b3807de47 Sample

modified 2026-05-22 06:59:32
BazaLoader (MalwareBazaar Abuse.ch)

77461abc7157340cedea763e2813c965 Sample

modified 2026-05-22 06:23:42
BazaLoader (MalwareBazaar Abuse.ch)

Documents.lnk Sample

modified 2026-05-22 02:09:04
BazaLoader (Abuse.ch)

f355eb875cebdf6418598393987aba03 Sample

modified 2026-05-22 00:52:22
BazaLoader (MalwareBazaar Abuse.ch)

f1ee4d45ec92b5cdbd820781f9a65894 Sample

modified 2026-05-21 23:44:38
BazaLoader (MalwareBazaar Abuse.ch)

44b44fbf4c7fbd56e8cf7411054aa0d6 Sample

modified 2026-05-20 15:12:40
BazaLoader (MalwareBazaar Abuse.ch)

ae5c387389575adab73f177a746b1f7e Sample

modified 2026-05-14 00:53:58
BazaLoader (MalwareBazaar Abuse.ch)

24189fcf3cb44ec17807a860cb8dfbdb.dll Sample

modified 2026-05-10 01:00:38
BazaLoader (Abuse.ch)

127839.xls.dll Sample

modified 2026-05-09 14:57:25
BazaLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

file Sample

modified 2026-05-07 12:15:04
Generic Malware (Hybrid-Analysis) · BazaLoader (MalwareBazaar Abuse.ch)

0x000500000001aba2-264.dat Sample

modified 2026-05-04 07:45:50
BazaLoader (Abuse.ch) · Generic.Malware (Abuse.ch)

16f919cf7e6b8e005ce5d4bbe968c9c5 Sample

modified 2026-05-03 08:52:53
BazaLoader (MalwareBazaar Abuse.ch)

96876015ec0de0704d7b51609979e297.dll Sample

modified 2026-05-01 07:30:47
BazaLoader (Abuse.ch)

SecuriteInfo.com.Variant.Tedy.67730.15459.9774 Sample

modified 2026-05-01 03:01:23
BazaLoader (MalwareBazaar Abuse.ch)

F2A47107C43371ECA44AD9D76D18BA09.bin Sample

modified 2026-04-30 18:53:49
BazaLoader (Abuse.ch)

Invoice and documents‮fdp.scr Sample

modified 2026-04-30 17:21:38
BazaLoader (MalwareBazaar Abuse.ch) · BazaLoader (Abuse.ch)

80060b128b6d4813f184d33b53972dea Sample

modified 2026-04-30 03:20:31
BazaLoader (MalwareBazaar Abuse.ch)

ac96920684c5c701f1c69152019d50ac Sample

modified 2026-04-29 08:54:07
BazaLoader (MalwareBazaar Abuse.ch)

d5bcb6d413a5f04533dbce9bae5ef67b.dll Sample

modified 2026-04-28 03:23:18
BazaLoader (Abuse.ch)

d9b7dd08b2d1cde2e076ec3c10948af1a472a610fa7e3179f4e6b42402870b31 Sample

modified 2026-04-27 06:13:17
BazaLoader (Abuse.ch) · Generic.Malware (Abuse.ch)

SecuriteInfo.com.UDS.Trojan.Win64.Kryplod.31210.6617 Sample

modified 2026-04-26 19:20:20
BazaLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

insucar.pdf Sample

modified 2026-04-26 15:45:12
BazaLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

f3bf04bfa6c87ee6e8f66fce0b5fac59 Sample

modified 2026-04-26 11:37:26
BazaLoader (MalwareBazaar Abuse.ch)

d9dc8d21d1b662803907276a1c131b2c Sample

modified 2026-04-26 10:59:51
BazaLoader (MalwareBazaar Abuse.ch)

628430a43571477dd00085cdcdaa9a834e030cb80e39ae19b6a107c1f904e2cf Sample

modified 2026-04-26 08:28:28
BazaLoader (MalwareBazaar Abuse.ch)

paerax64.docx Sample

modified 2026-04-26 08:12:10
BazaLoader (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

88498359a59efa03adb4b5afbba55bc7b185f087b8b8f10ba949eb8e2c7af3fc.xll Sample

modified 2026-04-26 06:32:17
BazaLoader (MalwareBazaar Abuse.ch)