bazarloader | hxxps://sakshamsanchar[.]org/wp-content/plugins/wp-roilbask/includes/?BOFUiEsOraXGmJ

General

Target
https://sakshamsanchar.org/wp-content/plugins/wp-roilbask/includes/?BOFUiEsOraXGmJ
Sample220118-t38s4acaf2

Score

10^/10

Malware Config

Targets

- Target
  https://sakshamsanchar.org/wp-content/plugins/wp-roilbask/includes/?BOFUiEsOraXGmJ
Score

10^/10

bazarloader discovery dropper loader spyware stealer
- Bazar Loader
  Detected loader normally used to deploy BazarBackdoor malware.
  loader dropper bazarloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Bazar/Team9 Loader payload
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Tries to connect to .bazar domain
  Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Bazar Loader

Process spawned unexpected child process

Bazar/Team9 Loader payload

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Tries to connect to .bazar domain

Loads dropped DLL

Reads user/profile data of web browsers

Checks installed software on the system

MITRE ATT&CK Enterprise v6

Tasks

static1

urlscan1

behavioral1