Bazar

MITRE ATT&CK: S0534 View on attack.mitre.org

Aliases: KEGTAP, Team9, Bazaloader, BEERBOT, Team9Backdoor, bazaloader, bazarloader, Bazar

First seen
2020-04-01 00:00:00
Malware type
backdoor, loader, downloader
Family
Malware family
Operating systems
windows
Related IoCs
241 (180 malicious)
Last IoC activity
2026-10-17 16:07:32
Profile updated
2026-07-07 12:37:50

Targeted industries: professional-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications transportation-and-logistics

Targeted regions: country_code:us country_code:de

Context

Bazar is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. Bazar reportedly has ties to TrickBot campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.

Recent IoC activity

180 malicious indicators in Maltiverse are attributed to Bazar (S0534). The 20 most recently updated:

TypeIndicatorUpdatedSources
file sample sub_9b7bdb4cb71e.bin 2026-10-18 3
file sample aclui.dll 2026-10-18 3
IP address 164.90.226.23 2026-10-18 3
IP address 162.33.179.46 2026-10-17 2
IP address 162.33.178.248 2026-10-14 2
file sample jaffacakes118_Virus.Win32.Sality.gen.cfb831b33ae69a25739a3 2026-10-14 1
file sample jaffacakes118_HEUR.Trojan.Win32.Generic.1b886e5d275afe9aec1fa4e0f4669ae9 2026-10-13 1
file sample 2026-10-11_40e04462ef344f9eff4dd33112db660b_cobalt-strike_icedid_njrat_satacom_vidar 2026-10-12 1
file sample 2026-10-11_8d3d642394238559642cedd2aa3f78c5_cobalt-strike_icedid_njrat_satacom_vidar 2026-10-12 1
file sample 2026-10-11_a9c2c9e9311a7d63a913d2690e77845d_cobalt-strike_icedid_njrat_satacom_vidar 2026-10-12 1
file sample 2026-10-11_eafcf555115cc3dcfec61a91782f1d43_cobalt-strike_icedid_njrat_satacom_vidar 2026-10-12 1
file sample Documents.lnk 2026-10-12 2
file sample jaffacakes118_Virus.Win32.Sality.gen.fc01f5f91a17453387e45 2026-10-10 1
file sample 5b6a96d9b85a18b6cc77d6c2bc59d067f84f2e0448cc13bf14a7fd3c5f95bf93 2026-10-09 1
IP address 194.40.243.33 2026-10-09 4
file sample 5ad3bb4b60d0574d6311d607c337139ab2fedf8420b6f733bbabf844037d8c6a 2026-10-09 1
IP address 45.14.226.23 2026-10-09 2
IP address 142.11.237.178 2026-10-09 3
IP address 45.15.131.126 2026-10-09 2
IP address 146.19.253.90 2026-10-09 3

Detection coverage

  • 5 YARA rules
  • 909 Sigma rules

Malware & tools used

  • File and Directory Discovery (attack-pattern)
  • Domain Trust Discovery (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Domain Account (attack-pattern)
  • Remote System Discovery (attack-pattern)
  • Malicious Link (attack-pattern)
  • Network Share Discovery (attack-pattern)
  • Process Injection (attack-pattern)
  • BITS Jobs (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • PowerShell (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Virtualization/Sandbox Evasion (attack-pattern)
  • Process Doppelgänging (attack-pattern)
  • Clear Persistence (attack-pattern)
  • Data from Local System (attack-pattern)
  • Dynamic API Resolution (attack-pattern)
  • System Language Discovery (attack-pattern)
  • System Time Discovery (attack-pattern)
  • Process Discovery (attack-pattern)
  • Multi-Stage Channels (attack-pattern)
  • Query Registry (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Software Discovery (attack-pattern)

Used by threat actors

Detection rules

  • CAPE_Bazar (yara-rule)
  • DITEKSHEN_INDICATOR_KB_ID_Bazarloader (yara-rule)
  • DITEKSHEN_MALWARE_Win_Bazarloader (yara-rule)
  • DITEKSHEN_MALWARE_Win_UNK05 (yara-rule)
  • ARKBIRD_SOLG_MAL_Bazarloader_Oct_2021_1 (yara-rule)

Reports & references

  • trellix.com — Evolution Of Bazarcall Social Engineering Tactics (report)
  • Microsoft — Bazacall Phony Call Centers Lead To Exfiltration And Ransomware (report)
  • proofpoint.com — First Step Initial Access Leads Ransomware (report)
  • advintel.io — Enter Karakurt Data Extortion Arm Of Prolific Ransomware Group (report)
  • blog.google — Exposing Initial Access Broker Ties Conti (report)
  • twitter.com — 1321865315513520128 (report)
  • Mandiant — Kegtap And Singlemalt With A Ransomware Chaser (report)
  • Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
  • CrowdStrike — Report2021Gtr (report)
  • securityintelligence.com — Trickbot Gang Doubles Down Enterprise Infection (report)
  • CrowdStrike — Wizard Spider Adversary Update (report)
  • zdnet.com — The Malware That Usually Installs Ransomware And You Need To Remove Right Away (report)
  • Broadcom/Symantec — The Ransomware Threat September 2021 (report)
  • web.archive.org — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
  • cronup.com — De Ataque Con Malware A Incidente De Ransomware (report)
  • pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
  • strapi.eurepoc.eu — Eu Repo C Apt Profile Conti Wizard Spider Dc2A733E18 (report)
  • Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
  • Palo Alto Unit 42 — Luna Moth Callback Phishing (report)
  • Trend Micro — Rpt Navigating New Frontiers Trend Micro 2021 Annual Cybersecurity Report (report)
  • cisoclub.ru — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
  • Trend Micro — Cyberattacks Are Prominent In The Russia Ukraine Conflict (report)
  • attackiq.com — Attack Graph Emulating The Conti Ransomware Teams Behaviors (report)
  • blog.bushidotoken.net — Lessons From Conti Leaks (report)
  • Palo Alto Unit 42 — Bumblebee Malware Projector Libra (report)

External references