2021-07-21 BazarLoader IOCs

THREAT IDENTIFICATION:  BAZARLOADER

SUBJECTS OBSERVED
Contact Submission

SENDERS OBSERVED
[email protected]

EMAIL BODY
name: Christina
email: [email protected]
message: Hello there! My name is Christina. Your website or a website
that your company hosts is violating the copyright protected images
owned by myself. Check out this document with the hyperlinks to my
images you used at www.<redacted>.com and my previous publications to find
the evidence of my copyrights. Download it right now and check this
out for yourself:
https://firebasestorage.googleapis.com/v0/b/files-d6e6c.appspot.com/o/download-dk3kvbbqk2.html?alt=media&token=e9774a52-79aa-4b10-9863-67a63a9e1087&l=235887401976653861

I really believe you have intentionally violated my legal rights under
17 USC Sec. 101 et seq. and could possibly be liable for statutory
damages as high as $150,000 as set-forth in Section 504 (c)(2) of the
Digital Millennium Copyright Act (DMCA) therein. This letter is
official notification. I demand the removal of the infringing
materials described above. Take note as a service provider, the Dmca
requires you, to remove and terminate access to the infringing content
upon receipt of this particular notification letter. In case you don't
stop the use of the previously mentioned infringing materials a
lawsuit can be started against you. I do have a good self-belief that
use of the copyrighted materials described above as presumably
infringing is not permitted by the legal copyright owner, its legal
agent, as well as law. I declare, under consequence of perjury, that
the information in this letter is accurate and that I am currently the
copyright proprietor or am authorized to act on behalf of the owner of
an exclusive right that is allegedly infringed. Regards, Christina
Morris 07/21/2021

MALDOC DOWNLOAD URLS
https://firebasestorage.googleapis.com/v0/b/files-d6e6c.appspot.com/o/download-dk3kvbbqk2.html?alt=media&token=e9774a52-79aa-4b10-9863-67a63a9e1087&l=235887401976653861

https://firebasestorage.googleapis.com/v0/b/files-d6e6c.appspot.com/o/download-dk3kvbbqk2.html?alt=media&token=e9774a52-79aa-4b10-9863-67a63a9e1087&data=04258728259875443

https://drive.google.com/uc?export=download&id=1WsuhRIiE37T19uuQkg_0z8lAarKmZyD1
https://drive.google.com/uc?export=download&id=18XdoojFcWJbV_sFG3jGeusXpExG0VS2C

MALDOC FILE NAMES
Stolen Images Evidence.zip
Stolen Images Evidence.js

MALDOC FILE HASHES
Stolen Images Evidence.zip
372465bc30e35f6fd15a4b12a51ef988

Stolen Images Evidence.js
c6545c4a32834f0026b9d17ab3e9425e

BAZARLOADER PAYLOAD DOWNLOAD URLS
http://menoiras.space/222g100/index.php
http://menoiras.space/222g100/main.php

BAZARLOADER PAYLOAD FILE HASHES
yeWvzid.dat (it's a .dll)
7441e18b28b78a1c9fb5323099ea1510

BAZARLOADER C2
https://3.223.192.20/union/low_item

DNS TRAFFIC (None resolved)
greencloud46a.bazar
whitestorm9p.bazar
yellowdownpour81.bazar

SUPPORTING EVIDENCE
https://app.any.run/tasks/44470730-363d-45a0-8ec3-291e3ee0cd93/