Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware loader/backdoor that uses a domain generation algorithm (DGA) to produce .bazar domains, resolves them to encrypted A records, XOR-transforms the IP bytes, and contacts command-and-control over HTTPS on port 443.
A malware loader/backdoor whose DGA was modified to generate more .bazar domains. It uses a time-dependent deterministic algorithm seeded by the current date to produce monthly domains, and the A record IP is XOR-obfuscated before being used for HTTPS communication.
A malware loader/backdoor that uses a .bazar domain generation algorithm (DGA) for command-and-control resolution. The analyzed sample dynamically loads Windows APIs, uses encrypted strings and arithmetic substitution obfuscation, and generates large numbers of pseudo-random .bazar domains based on the current month and year.
A malware loader/backdoor that uses a Domain Generation Algorithm (DGA) with .bazar domains for command-and-control discovery. In this version, it generates 8-character second-level domains seeded by the current month and year, with additional randomness from processor tick count, and employs code obfuscation such as arithmetic substitution, encrypted strings, and dynamic API loading.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.