2021-02-15 Likely Bazar/BazarLoader IOCs

THREAT IDENTIFICATION:  Bazar/BazarLoader/CobaltStrike Stager??

The landing page had been taken down by the time I tried to get the payload.

SUBJECTS OBSERVED
, lawyer request
Lastname, lawyer request

SENDERS OBSERVED
chelsey.dupre@secondnaturephotography.com
Cheryl.Quattro@live-operators.com
Emily.Woods@newdayrefinancing.com
INSERT.INTO@secondnaturephotography.com
Jennifer.Lusty@secondnaturephotography.com
Julie.Dixon@secondnaturephotography.com
Kimberly.Finch@live-operators.com
Kimberly.Finch@newdayrefinancing.com
Linda.Garrett@newdayrefinancing.com
Matthew.Wiley@newdayrefinancing.com
Mike.Fiorello@secondnaturephotography.com
Que.Walker@secondnaturephotography.com
Tammy.Ung@newdayrefinancing.com
Tammy.Ung@secondnaturephotography.com

BAZAR LANDING PAGES
https://lawyer-complaint-request-11f.subscribemenow.com/

BAZAR MALDOC FILE HASHES
N/A

BAZAR PAYLOAD DOWNLOAD
N/A

BAZAR PAYLOAD FILE HASHES
N/A

BAZAR C2
N/A