2020-09-15 - BazarLoader malware from Google Docs page

2020-09-15 - BAZARLOADER MALWARE FROM GOOGLE DOCS PAGE

REFERENCE:

- https://twitter.com/malware_traffic/status/1305970293253574661

NOTE:

- A link to this Google Docs page was likely sent through malspam.

GOOGLE DOCS URL FOR DOWNLOAD PAGE:

- hxxps://docs.google[.]com/document/d/e/2PACX-1vT-goZJung2xJeUM9yzqTqRV8oSbrbFaGr23IwyInIPyNL7HUBBetwB7y5FQehfNU_mg1wWHhP2ceeT/pub

EXAMPLES OF URLS FROM THE DOWNLOAD PAGE:

- hxxps://www.google[.]com/url?q=hxxps://unitedyfl[.]com/Print_Preview.exe&sa=D&ust=1600182579826000&usg=AOvVaw2eIp2TcrA_2xIkQMxOmL74

- hxxps://www.google[.]com/url?q=hxxps://rayanat[.]com/Print_Preview.exe&sa=D&ust=1600194315747000&usg=AOvVaw30078SJ1v2wGq_FLGpEAbf

- hxxps://www.google[.]com/url?q=hxxps://calacatta[.]com/Preview.exe&sa=D&ust=1600203326242000&usg=AOvVaw1BN3mdAtVWqS3An8X-Vy9L

BAZARLOADER SAMPLES:

- SHA256 hash: 34cc67888cd38da7aeb52508b48ad71287c402aecb72bccca7cbd3a0cd8fe985
- File size: 257,208 bytes
- File location: hxxps://unitedyfl[.]com/Print_Preview.exe
- Sandbox analysis: https://app.any.run/tasks/975fb69c-b5eb-49c7-8d8f-332d34b6f46b/

- SHA256 hash: 09557d538aee094d168a4b4fb5174d742fe81dd59dd27e2eee078fb3f10d9017
- File size: 582,840 bytes
- File location: hxxps://rayanat[.]com/Print_Preview[.]exe
- Sandbox analysis: https://app.any.run/tasks/d0b1de23-ac5a-4274-afa0-4066fcb51844/

- SHA256 hash: 18fe9ceab0a17ddc71f7b7a206c1c127d62a0a86c62573b8c018ab562da1fd6e
- File size: 257,208 bytes
- File location: hxxps://calacatta[.]com/Preview.exe
- Sandbox analysis: https://app.any.run/tasks/b21c7dbe-7a74-48d3-9762-874c3c80c9e0/