2020-12-10 Bazar IOCs

THREAT ATTRIBUTION:  BAZAR

SUBJECTS OBSERVED
RE: <Company Name> termination list
RE: <Company Name>: employee bonuses

SENDERS OBSERVED
catrina.suldon@tycoglobalfinancialsolutions.com
Jacqueline.Harris@siliconpeak.net
Andrea.Evans@zippd.com
TIFFANIE.LOVETT@siliconpeak.net

BAZAR PAYLOAD FILE HASHES
PreviewDoc.exe
532524ec1e7a51b51f948fdc79bd0f83

DIGITAL SIGNATURE
OOO Inversum

LANDING PAGE URLS
https://docs.google.com/document/d/e/2PACX-1vRbIITKRwwDZi-IGGLJbZw9xlJyWGGiHKhifh6h2pZrujOQIpi792gliqaif2i_yYs91luHfJWOBgul/pub
https://docs.google.com/document/d/e/2PACX-1vQ47uql5TBmOkBRUZTMZBQpyaFKle50tquSGz9dilBBehe23YLqU2T6UszPtJ4qrICJnRlBCYRKN6jL/pub

PAYLOAD DOWNLOAD URLS
https://www.google.com/url?q=https://drive.google.com/uc?export%3Ddownload%26id%3D1TjgOQjFKqGdRW3A0GjfHCgrXu1scBx5A&sa=D&ust=1607627596249000&usg=AOvVaw3zj3kOwq3dDu2CrlfCocU0

BAZAR C2 (Possible C2s)
https://ecosmartdetaillng.com
51.77.94.237

https://chukysdetall.com.com