Rewterz Threat Alert – The BazarCall Method BazarLoader Malware Uses – Active IOCs

Severity

High

Analysis Summary

The BazarLoader malware is a small backdoor (a TrickBot adjacent malware) to an infected victim Windows host. BazarLoader currently uses a BazarCall method that infects the victim’s system and provides cybercriminals with backdoors that can be used in the future to send follow-up malware, scan the environment and exploit other vulnerable hosts on the network.

Researchers have reported the latest method used by threat actors to spread the malware; the call-center-based bazarLoader distribution method utilizes emails with a trial subscription-based theme that encourages potential victims to call a phone number. The victim is hoodwinked into thinking that they have subscribed to a service they didn’t sign up for and are directed to call a certain number for help. The call center operator directs the victim into downloading an infected excel sheet that is installed upon unsubscribing from the service.

The following chain of events takes place in the BazarCall Method:

• A trial subscription-themed email is received by the victim that directs them to call a phone number to a call center for assistance.
• The victim calls the phone number to unsubscribe from the service.
• The call center operator guides them to a fake company website.
• Upon clicking the unsubscribe option, a Microsoft Excel file is downloaded from the website.
• The call center operator instructs the victim to enable macros on the downloaded Excel file.
• The BazarLoader Malware is installed on the system.
• The victim is informed by the call center operator that the unsubscription was successful.
• BazarLoader generates command and control (C2) traffic from the infected Windows host.
• Backdoor access through BazarLoader leads to post-infection activities.

Impact

Data Breach

Affected Vendors

Microsoft

Affected Products

Windows

Indicators of Compromise

Destination IP

• 198[.]54[.]117[.]244
• 176[.]111[.]174[.]57
• 176[.]111[.]174[.]58
• 176[.]111[.]174[.]61
• 176[.]111[.]174[.]62
• 198[.]54[.]117[.]244
• 104[.]21[.]74[.]174
• 172[.]67[.]160[.]87
• 176[.]111[.]174[.]57
• 82[.]194[.]74[.]104

MD5

• 14089c2d5a4207dd80f71fb258200848
• 5ad4845793b5dc3308172b39f3c3dbc7
• dc37192b5c4c8c4f94c73c18ce5e3829

SHA-256

• ae1a1fcbc0f32a7c53cee9c5d27583d21309d824e1524f85812e4b6abad8de4e
• 0055ea96cd5145ea54f3e0bd488451c1a814dd1969160cb18137922a884ffa5e
• 09affa7f8e253edd9d4deda4413fba040829ff95b9263dda6f6bf8f269e27c0b
• f617eaecc30a486198c85981d07f22b090c7f3c1cd88565a87865f58ec479857
• 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
• f3b5cf1e40aed4567a8996cf107285907d432b4bc8cc3d0b46aae628813d82d4
• 2632c0cc222a6d436b50a418605a7bd4fa8f363ab8d93d10b831cdb28a2ac1bc
• db53f42e13d2685bd34dbc5c79fad637c9344e72e210ca05504420874e98c2a6
• 975ea7fce484089ec7d54b0abf2eecc16a1d04cd3e610a9e67cc3ae2885f3899
• f28d451125fe14399cf4107e65ff11c49edf899a9d256563d177bce4880e9dd0
• fb94f0c62b1eb990c2c39413cda78b45690e275aceb85af58bb84c887fc4bb67
• c1add84da66b44da51f1ce07c4d1afafa84aa8ad19092bb04f57c0d627a70b0d
• 536d1a135f6f0a9bc337108a2b10ce81515c5bc26b654ec9f8e4b5e53d06c959
• c51bf8c74311b8941dca2f63a0850e61c1058af6af0ac42d81c2d85cd64d37cb
• 2e5275c35b262674705f3c2bd6becc80a067f2660798881d0f5344ac97bd592d
• 5b05cae0880543c3adc28a2d5a45af4931de6d2b4197d2d3c26e4471dd4cf2a8
• fa5df8c17cdbe12483e369e947f545578ee14ae87a3f4af656cf62dc5e7aa81a

SHA1

• 80fa3d47f321108d7c956680ac1b1f5c611d6277
• 4285a93ec1a49f28cb2542af2a2bafc08e4f8a18
• 0aa6bb11a11dade2269d90b2781ed0a517362012

URL

• http[:]//whynt[.]xyz/campo/w/w
• http[:]//veso2[.]xyz/campo/r/r1
• http[:]//about2[.]xyz/campo/a/a1
• http[:]//basket2[.]xyz/campo/u/u1
• http[:]//dance4[.]xyz/campo/d8/d9
• https[:]//www[.]gnu[.]org/software/campo/d8/d9
• http[:]//glass3[.]xyz/campo/gl/gl3
• http[:]//idea5[.]xyz/campo/id/id8
• http[:]//keep2[.]xyz/campo/jl/jl7
• http[:]//whynt[.]xyz/uploads/files/dl8x64[.]exe
• http[:]//admin[.]yougleeindia[.]in/theme/js/plugins/o1e[.]exe
• http[:]//admin[.]yougleeindia[.]in/theme/js/plugins/rt3ret3[.]exe
• http[:]//about2[.]xyz/uploads/files/ret5er[.]exe
• http[:]//www[.]carsidecor[.]com/wp-content/uploads/2021/04/cv76[.]exe
• http[:]//dance4[.]xyz/uploads/files/10r3[.]exe
• http[:]//glass3[.]xyz/uploads/files/hah5[.]exe
• http[:]//idea5[.]xyz/uploads/files/ratan[.]exe
• http[:]//idea5[.]xyz/uploads/files/rets[.]exe
• http[:]//keep2[.]xyz/uploads/files/suka[.]exe

Remediation

• Download the latest patches for all products.
• Keep Windows up-to-date.
• Practice cyber vigilance online and maintain healthy internet habits.
• Keep an eye out for malicious emails and upgrade spam properties in email applications.
• Never download files from malicious websites.
• Run and update anti-virus software regularly.