2020-09-25 Bazar IOCs

THREAT ATTRIBUTION:  BAZAR

SUBJECTS OBSERVED
RE: Firstname, our meeting

SENDERS OBSERVED
Zhanatan Cook <[email protected]>

EMAIL BODY
Good morning, First Last
You can find the list of important questions that need to be highlighted at this meeting in a form in PDF:
https://files.constantcontact.com/6426e42d701/6ab40cd7-edf1-46db-a0c4-aa2adf360a3a.pdf
Company Name

Please, be informed that our company`s CEO has planned to hold a meeting at the end of day to be acquainted with performance data of all departments of our company.
Please, contact me ASAP if you have any questions because this is urgent!

Best regards,
Zhanatan Cook
Head Office Secretary

BAZAR PAYLOAD FILE HASHES
Document-Print.exe
eaad7777d588deef9db962f2863f8b9b

LANDING PAGE PDF FILE HASHES
4Employee
9b94c44d3022533137501d99e16f3022

MALDOC DISTRIBUTION URLS
https://u12056208.ct.sendgrid.net/ls/click?upn=uWsEeQFQD9ViDqyTUu544F8bLk4jEL1y-2FIYaqwYxKAXSnQ7gJ-2FbYZyx-2BDzzEf4znAhym2-2BX8IyyWEzh2tvz7KXD8g10oEXhyX-2FAnl8PSd-2FGr33ndbXwBwCSkNnp63Qxg4IRs_ZAK9SMimQo8C4l8KF-2FsIS-2F36aJpqfKhkX2vgHHewwugFmFLVJD2UY0PiwLqCYtjx4SSb-2FxfYLq8NJoal27-2Bh3dRMMG26t3xuKNZzkRzrX3EJQbywsC3G41gdk7lMe-2BLivNZHuNBA4EJyFau6XlwVm5o2TXsPn4kDbmGQJnNjvE2Y-2FlSAKNcxRxKvFsjlN3bchzlAh3ZniJucpK5fpRSWtr5A-2BYtyafAzXI2wrgPi12EzzzibxUxPLcIjzdanzny8

https://drive.google.com/uc?export=download&confirm=no_antivirus&id=1Sc8L7HqsC8_pkQc7xASsIab0QOUoFtOO

LANDING PAGE
https://files.constantcontact.com/6426e42d701/6695676c-0be4-42dc-b0bb-b16e01ddaeaf.pdf
https://files.constantcontact.com/6426e42d701/6ab40cd7-edf1-46db-a0c4-aa2adf360a3a.pdf

BAZAR PAYLOAD URLS
https://doc-0g-6o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/icl8fbmn9oiii6m8pk1nr50rjm9bmeva/1601050800000/16947237457384943505/*/1Sc8L7HqsC8_pkQc7xASsIab0QOUoFtOO?e=download

BAZAR C2
https://185.142.99.8/api/v202
https://185.142.99.8/api/v202
https://185.142.99.8/api/v204