API tools faq
paste
ExecuteMalware

2020-09-30 Bazar IOCs

ExecuteMalware
Sep 30th, 2020
3,040
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.36 KB | None | 0 0
raw download clone embed print report
  1. THREAT ATTRIBUTION: BAZAR/BAZALOADER
  2.  
  3. SUBJECTS OBSERVED
  4. RE: my call, <Firstname>
  5. RE: what time?
  6. Re: what time? at office, <Lastname>
  7.  
  8. SENDERS OBSERVED
  9. assist@onlyfruit.net
  10. assistance@onlyfruit.net
  11. centeraloffice@sd.anglersarsenal.com
  12. headoffice@on.ramacomputers.ca
  13. headoffice@pw.bigrockinmom.com
  14. headoffice@ssl.raazfood.ca
  15. info@sgcpromo.com
  16. managementoffice@sec.raazfoods.com
  17. no-reply@telecombill.net
  18. office@sw.associatedsantabarbara.com
  19. office@wd.makingfitfit.com
  20. support@mooveru.com
  21. support@mygritwire.com
  22. support@reflexionesdiarias.net
  23.  
  24. BAZAR PAYLOAD FILE HASHES
  25. 966c84ff355b11c6b4960ceca58704f5
  26.  
  27. LANDING PAGE URLS
  28. https://docs.google.com/document/d/e/2PACX-1vSlTDXLKwhIyqkQ8FShYijXNC2SvXoX4_ACfRF_ur-HAItkjzHhEn1CqBaWvTjoI0Jagbe6sdrrBLc5/pub
  29. https://docs.google.com/document/d/e/2PACX-1vTqAijwQf6TANg8btSvoufjRDvTk2t8je8dU0h6QcoXDQBvfa8FD0RgC15_s85o8n6Orp-WcWk4Mm-v/pub
  30. https://docs.google.com/document/d/e/2PACX-1vTsGuzrSsTi8jhbKyvPUKNA9m5Pk_B40cV9PpZOAWss34w_n8Xm07KA2uX4U_CNP6Wr_8AZbm8BIRVu/pub
  31. https://docs.google.com/document/d/e/2PACX-1vSlTDXLKwhIyqkQ8FShYijXNC2SvXoX4_ACfRF_ur-HAItkjzHhEn1CqBaWvTjoI0Jagbe6sdrrBLc5/pub
  32. https://docs.google.com/document/d/e/2PACX-1vTqAijwQf6TANg8btSvoufjRDvTk2t8je8dU0h6QcoXDQBvfa8FD0RgC15_s85o8n6Orp-WcWk4Mm-v/pub
  33. https://docs.google.com/document/d/e/2PACX-1vSlTDXLKwhIyqkQ8FShYijXNC2SvXoX4_ACfRF_ur-HAItkjzHhEn1CqBaWvTjoI0Jagbe6sdrrBLc5/pub
  34. https://docs.google.com/document/d/e/2PACX-1vTqAijwQf6TANg8btSvoufjRDvTk2t8je8dU0h6QcoXDQBvfa8FD0RgC15_s85o8n6Orp-WcWk4Mm-v/pub
  35. https://docs.google.com/document/d/e/2PACX-1vSlTDXLKwhIyqkQ8FShYijXNC2SvXoX4_ACfRF_ur-HAItkjzHhEn1CqBaWvTjoI0Jagbe6sdrrBLc5/pub
  36. https://docs.google.com/document/d/e/2PACX-1vTqAijwQf6TANg8btSvoufjRDvTk2t8je8dU0h6QcoXDQBvfa8FD0RgC15_s85o8n6Orp-WcWk4Mm-v/pub
  37. https://docs.google.com/document/d/e/2PACX-1vQ2WZ6MMjC7qPmdB_EFnCyHskJ27X7rLc5pAbyxVJSpKKgcN3Q7j_b45gW6ueLliwJr4nEhVRwAM6AI/pub
  38. https://docs.google.com/document/d/e/2PACX-1vTsGuzrSsTi8jhbKyvPUKNA9m5Pk_B40cV9PpZOAWss34w_n8Xm07KA2uX4U_CNP6Wr_8AZbm8BIRVu/pub
  39. https://docs.google.com/document/d/e/2PACX-1vQ2WZ6MMjC7qPmdB_EFnCyHskJ27X7rLc5pAbyxVJSpKKgcN3Q7j_b45gW6ueLliwJr4nEhVRwAM6AI/pub
  40. https://docs.google.com/document/d/e/2PACX-1vSlTDXLKwhIyqkQ8FShYijXNC2SvXoX4_ACfRF_ur-HAItkjzHhEn1CqBaWvTjoI0Jagbe6sdrrBLc5/pub
  41. https://docs.google.com/document/d/e/2PACX-1vTqAijwQf6TANg8btSvoufjRDvTk2t8je8dU0h6QcoXDQBvfa8FD0RgC15_s85o8n6Orp-WcWk4Mm-v/pub
  42. https://docs.google.com/document/d/e/2PACX-1vSlTDXLKwhIyqkQ8FShYijXNC2SvXoX4_ACfRF_ur-HAItkjzHhEn1CqBaWvTjoI0Jagbe6sdrrBLc5/pub
  43. https://docs.google.com/document/d/e/2PACX-1vTqAijwQf6TANg8btSvoufjRDvTk2t8je8dU0h6QcoXDQBvfa8FD0RgC15_s85o8n6Orp-WcWk4Mm-v/pub
  44. https://docs.google.com/document/d/e/2PACX-1vSlTDXLKwhIyqkQ8FShYijXNC2SvXoX4_ACfRF_ur-HAItkjzHhEn1CqBaWvTjoI0Jagbe6sdrrBLc5/pub
  45. https://docs.google.com/document/d/e/2PACX-1vTqAijwQf6TANg8btSvoufjRDvTk2t8je8dU0h6QcoXDQBvfa8FD0RgC15_s85o8n6Orp-WcWk4Mm-v/pub
  46. https://docs.google.com/document/d/e/2PACX-1vSlTDXLKwhIyqkQ8FShYijXNC2SvXoX4_ACfRF_ur-HAItkjzHhEn1CqBaWvTjoI0Jagbe6sdrrBLc5/pub
  47. https://docs.google.com/document/d/e/2PACX-1vTqAijwQf6TANg8btSvoufjRDvTk2t8je8dU0h6QcoXDQBvfa8FD0RgC15_s85o8n6Orp-WcWk4Mm-v/pub
  48. https://docs.google.com/document/d/e/2PACX-1vQ2WZ6MMjC7qPmdB_EFnCyHskJ27X7rLc5pAbyxVJSpKKgcN3Q7j_b45gW6ueLliwJr4nEhVRwAM6AI/pub
  49. https://docs.google.com/document/d/e/2PACX-1vSlTDXLKwhIyqkQ8FShYijXNC2SvXoX4_ACfRF_ur-HAItkjzHhEn1CqBaWvTjoI0Jagbe6sdrrBLc5/pub
  50. https://docs.google.com/document/d/e/2PACX-1vTqAijwQf6TANg8btSvoufjRDvTk2t8je8dU0h6QcoXDQBvfa8FD0RgC15_s85o8n6Orp-WcWk4Mm-v/pub
  51. https://docs.google.com/document/d/e/2PACX-1vSlTDXLKwhIyqkQ8FShYijXNC2SvXoX4_ACfRF_ur-HAItkjzHhEn1CqBaWvTjoI0Jagbe6sdrrBLc5/pub
  52. https://docs.google.com/document/d/e/2PACX-1vTqAijwQf6TANg8btSvoufjRDvTk2t8je8dU0h6QcoXDQBvfa8FD0RgC15_s85o8n6Orp-WcWk4Mm-v/pub
  53. https://docs.google.com/document/d/e/2PACX-1vQ2WZ6MMjC7qPmdB_EFnCyHskJ27X7rLc5pAbyxVJSpKKgcN3Q7j_b45gW6ueLliwJr4nEhVRwAM6AI/pub
  54. https://docs.google.com/document/d/e/2PACX-1vRD18SMRqTb8GqUi9OeZbeMGgm3qAKfP94U-8CM7s8W1RlA6CmkpJ5ZZaqAzH07yA-rflst4tJiNJ5g/pub
  55.  
  56. BAZAR C2
  57. https://bubl6g.com/api/v202
  58. https://bubl6g.com/api/v204
  59. https://gate56dc.com/23c55b2cb0637e6dfa0f80a62ca03dc3/2
  60. https://gate56dc.com/23c55b2cb0637e6dfa0f80a62ca03dc3/4
  61.  
  62. SUPPORTING EVIDENCE
  63. https://twitter.com/James_inthe_box/status/1311388814376534016
  64. https://app.any.run/tasks/6829a6b6-7444-400a-8888-b95ff3875ef6/
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!