Loading malware…
Bazar, also known as BazaLoader, KEGTAP, and Team9, is a Windows backdoor malware family with development ties to the TrickBot group and operational associations with Wizard Spider. Multiple threat actors use it to establish footholds in high-value targets and execute additional payloads, including Cobalt Strike, IcedID, TrickBot, and Emotet.
Bazar supports command-and-control-directed execution, including running PowerShell scripts and downloading and executing additional malware. Its discovery capabilities include identifying the infected user's username, the current process, the host's IP address and NetBIOS name, remote systems, and shared drives within a domain. It can enumerate remote systems using the Windows Net utility, inject code using VirtualAllocExNuma, and establish persistence through scheduled tasks and registry-based automatic execution.
Distribution methods include phishing emails containing malicious links and spearphishing attachments. Wizard Spider has used macro-enabled Microsoft Office documents and PDFs containing malicious links to deliver Bazar.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
the seller offered two types of weaponized Microsoft Office documents (maldocs) to users: one that exploits a known vulnerability in Microsoft Office (CVE-2017-8570) and another that uses a malicious macro.
Additionally, some of the infrastructure that hosted the oleObjects utilized in the August 2021 attacks abusing CVE-2021-40444 were also involved in the delivery of BazaLoader and Trickbot payloads — activity that overlaps with a group Microsoft tracks as DEV-0193. | In August, Microsoft Threat Intelligence Center (MSTIC) identified a small number of attacks (less than 10) that attempted to exploit a remote code execution vulnerability in MSHTML using specially crafted Microsoft Office documents. These attacks used the vulnerability, tracked as CVE-2021-40444, as part of an initial access campaign that distributed custom Cobalt Strike Beacon loaders.
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.
This actor has predominantly used BazaLoader since April of 2020, but on February 3rd, 2021 they distributed a new malware we are calling NimzaLoader... there has been some research community analysis suggesting that NimzaLoader is just another variant of BazaLoader, but based on our observations of significant differences, we are tracking this as a distinct malware family.
Domains serving Bazar loader files ... Bazar domains ... Operational Backdoor
Microsoft attributes this campaign to Storm-0249, an access broker active since 2021 and known for distributing, at minimum, BazaLoader, IcedID, Bumblebee, and Emotet malware.
BazaLoader is a downloader written in C++ whose primary function is to download and execute additional modules. It was first observed in the wild in April 2020 and since has steadily been adopted by more actors.
TA578 uses email campaigns to deliver malware like Ursnif, IcedID, KPOT Stealer, Buer Loader, and BazaLoader, as well as Cobalt Strike.
49 distinct techniques documented for this family, organized by ATT&CK tactic.
250 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
158 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Bazar is a backdoor used by Conti to gain access to targets; the article says it was formerly part of TrickBot and later became a stand-alone tool used against higher-value targets.
Included in an unverified list of malware families allegedly tested against ABLE's anti-analysis bypass approach.
A malware/tooling family mentioned in passing as connected with Cobalt Strike and TrickBot.
Bazar is referenced as a loader used in the same Ryuk campaign to gain initial access before follow-on tooling such as SystemBC and ransomware deployment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.