MITRE ATT&CKsoftware (malware)
S0534 Bazar
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- KEGTAP, Team9, Bazaloader
- Version
- 2.0
- Created
- 2020-11-18
Description
Bazar is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. Bazar reportedly has ties to TrickBot campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.
Related
Uses · MITRE ATT&CK (51)
- T1685 Disable or Modify Tools technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1027.007 Dynamic API Resolution sub-technique
- T1070.009 Clear Persistence sub-technique
- T1614.001 System Language Discovery sub-technique
- T1036.007 Double File Extension sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1204.001 Malicious Link sub-technique
- T1568.002 Domain Generation Algorithms sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.003 Time Based Checks sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1087.001 Local Account sub-technique
- T1087.002 Domain Account sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.002 Software Packing sub-technique
- T1553.002 Code Signing sub-technique
- T1070.004 File Deletion sub-technique
- T1547.004 Winlogon Helper DLL sub-technique
- T1547.009 Shortcut Modification sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1055.012 Process Hollowing sub-technique
- T1055.013 Process Doppelgänging sub-technique
- T1053.005 Scheduled Task sub-technique
- T1518 Software Discovery technique
References
- https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles Cybereason Bazar July 2020
- https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html FireEye KEGTAP SINGLEMALT October 2020
- https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ Microsoft Ransomware as a Service
- https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/ NCC Group Team9 June 2020
- https://www.crowdstrike.com/blog/wizard-spider-adversary-update/ CrowdStrike Wizard Spider October 2020