███████╗██╗ ██╗██╗██╗ ███╗ ███╗██╗ ██╗████████╗███████╗██╗ ██╗ ██╔════╝██║ ██║██║██║ ████╗ ████║██║ ██║╚══██╔══╝██╔════╝╚██╗██╔╝ █████╗ ██║ ██║██║██║ ██╔████╔██║██║ ██║ ██║ █████╗ ╚███╔╝ ██╔══╝ ╚██╗ ██╔╝██║██║ ██║╚██╔╝██║██║ ██║ ██║ ██╔══╝ ██╔██╗ ███████╗ ╚████╔╝ ██║███████╗ ██║ ╚═╝ ██║╚██████╔╝ ██║ ███████╗██╔╝ ██╗ ╚══════╝ ╚═══╝ ╚═╝╚══════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝

⚠

BazarLoader

loader2 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:

BazarLoader

CATEGORY:

LOADER

DESCRIPTION:

BazarLoader is a sophisticated loader malware that has been observed in various cybercriminal campaigns. The malware is designed to download and execute additional payloads on compromised systems and has been analyzed for its reverse engineering techniques and multi-stage attack capabilities.

ALIASES:

BazarLoader

TAGS:

payload_deliverymulti_stagereverse_engineeringcybercriminalevasion_techniques

[MUTEX_SIGNATURES](2)

[MUTEX_01]

{b837ef4f-10ee-4821-ac76-2331eb32a23f}

ANALYST: @adhikara13 DATE: 2024-07-16

REFERENCES:

https://www.0ffset.net/reverse-engineering/analysing-the-main-bazarloader/

[MUTEX_02]

{0caa6ebb-cf78-4b01-9b0b-51032c9120ce}

ANALYST: @adhikara13 DATE: 2024-07-16

REFERENCES:

https://www.0ffset.net/reverse-engineering/analysing-the-main-bazarloader/

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:

⚠Unknown

FIRST_OBSERVED:

2020

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:2

THREAT_ACTORS:1

ALIASES:1

TAGS:5

CATEGORY:LOADER

Malware profile loaded successfully