^[2][3]

^[1][4]

^[5]

Bazar can identify administrator accounts on an infected host.^[4]

Bazar has the ability to identify domain administrator accounts.^[4][6]

Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications.^[1][4][7]

Bazar has been downloaded via Windows BITS functionality.^[4]

Bazar can create or add files to Registry Run Keys to establish persistence.^[1][4]

Bazar can use Winlogon Helper DLL to establish persistence.^[8]

Bazar can establish persistence by writing shortcuts to the Windows Startup folder.^[1][4]

Bazar can execute a PowerShell script received from C2.^[4][3]

Bazar can launch cmd.exe to perform reconnaissance commands.^[1][8]

Bazar can retrieve information from the infected machine.^[1]

Bazar can decrypt downloaded payloads.Bazar also resolves strings and other artifacts at runtime.^[1][4]

Bazar can useNltest tools to obtain information about the domain.^[1][4]

Bazar can implement DGA using the current date as a seed variable.^[1]

Bazar can send C2 communications with XOR encryption.^[4]

Bazar can use TLS in C2 communications.^[8]

Bazar has the ability to use an alternative C2 server if the primary server fails.^[4]

Bazar can enumerate the victim's desktop.^[1][4]

Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.^[4]

Bazar can delete its loader using a batch file in the Windows temporary folder.^[4]

Bazar's loader can delete scheduled tasks created by a previous instance of the malware.^[4]

Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such asCobalt Strike.^[1][8][4][3]

Bazar can create a task named to appear benign.^[1]

TheBazar loader has named malicious shortcuts "adobe" and mimicked communications software.^[1][4][3]

TheBazar loader has used dual-extension executable files such as PreviewReport.DOC.exe.^[1]

TheBazar loader is used to download and execute theBazar backdoor.^[1][8]

Bazar can use various APIs to allocate memory and facilitate code execution/injection.^[1]

Bazar can enumerate shared drives on the domain.^[4]

Bazar has a variant with a packed payload.^[1][8]

Bazar can hash then resolve API calls at runtime.^[1][4]

Bazar has used XOR, RSA2, and RC4 encrypted files.^[1][4][3]

Bazar has been spread via emails with embedded malicious links.^[1][8][3]

Bazar can identity the current process on a compromised host.^[1]

Bazar can inject code through callingVirtualAllocExNuma.^[1]

Bazar can inject into a target process including Svchost, Explorer, and cmd using process hollowing.^[1][4]

Bazar can inject into a target process using process doppelgänging.^[1][4]

Bazar can queryWindows\CurrentVersion\Uninstall for installed applications.^[1][4]

Bazar can enumerate remote systems using Net View.^[1]

Bazar can create a scheduled task for persistence.^[1][4]

Bazar can query the Registry for installed applications.^[1]

Bazar can identify the installed antivirus engine.^[1]

Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY. LTD.^[1]

Bazar can fingerprint architecture, computer name, and OS version on the compromised host.Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.^[1][4]

Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian.^[4]

Bazar can collect the IP address and NetBIOS name of an infected machine.^[1]

Bazar can identify the username of the infected user.^[4]

Bazar can collect the time on the compromised host.^[1][4]

Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.^[1][8][3]

Bazar can attempt to overload sandbox analysis by sending 1550 calls toprintf.^[1]

Bazar can use a timer to delay execution of core functionality.^[4]

Bazar downloads have been hosted on Google Docs.^[1][8]

Bazar can execute a WMI query to gather information about the installed antivirus engine.^[1][6]

^[9]

^[3][5]

^[7]