How to remove BazarLoader malware

BazarLoader malware – dangerous backdoor operated by Trickbot cybercriminal group

BazarLoader is a malicious program categorized as a Trojan and a backdoor – it is designed to infiltrate Windows machines and grant the attackers secret access to them. Once installed, the malware can perform various malicious functions, although the main purpose of the threat is to deliver other malware. While the final payload is not defined and can be literally anything, cybersecurity experts observed a deployment of Ryuk ransomware, which encrypts all personal files on all the computers connected to the network and then demands a ransom for the decryption tool.

BazarLoader malware has been used by the same cybercriminals who were actively spreading the infamous Trickbot Trojan, usually delivered via spam email campaigns. Phishing emails might be highly targeted or sent to random users and include various topics, including COVID-19 pandemic, business inquiries, fake customer complaint forms, etc.

The cybercriminal gang behind BazarLoader malware chose this malware due to its simplicity and increased obfuscation. Trickbot, which is considered one of the most prevalent Trojans in the world, has been analyzed by many leading security research groups, hence became much easier to detect and stop.

Despite this, many security solutions can detect and remove BazarLoader virus before it manages to cause any harm. One of the observed malicious email attachment samples (Print_Preview.exe) is detected as follows on Virus Total:^[1]

• Trojan.GenericKD.43838874
• Backdoor:Win64/Zarab!MSR
• Trojan.Trickster.Gen
• Win64:CrypterX-gen [Trj]
• Win/malicious_confidence_100% (W)
• Trojan.Bazar
• A Variant Of Win64/Kryptik.CAK, etc.

The initial attack of BazarLoader malware starts with a phishing email that is often highly targeted. Many security researchers that analyzed the campaign uncovered that most of the emails are presented as customer complaints. Here is one of the examples:^[2]

Why i can't reach you on the phone? I am on my way to XXX.

Because of customer complaint #7592 on you from last Friday, we will process termination process.
here is the copy in PDF: [Google docs link]

Please call me back till i will process additional debit from your acc.

HR Manager

Since the link is directing to Google Docs, victims are more likely to proceed. Once the link is clicked, they are redirected to a web-based PDF document, which includes another link. This time, by clicking on it, users would begin the installation of the BazarLoader malware.

As soon as the infection process is complete, the virus will install the BazarBackdoor part of the payload, which would inject malicious components into legitimate Windows processes, such as cmd.exe, explorer.exe, and svchost.exe. During this time, a scheduled task is also established on the system for the malware to start with each Windows boot.^[3] After performing some more downloads, BazarLoader malware will finally deploy Ryuk ransomware.

Once that is complete, malicious actors can ask victims for high sums as ransoms (typically, 10 to 50 bitcoin – approx. $114k – $570k at the time of the writing) for data recovery. Thus, BazarLoader seems like a great choice for cybercriminals due to low detection rates, which also guarantees high profits due to the ransomware component within the campaign.

BazarLoader malware removal is not the hardest process as long as adequate security software (such as SpyHunterCombo Cleaner or MalwarebytesMalwarebytes) is used, although the encrypted files or a data leak can be the most devastating side-effects of the infection. Once you delete malware from the system, experts also recommend scanning the device with a repair tool such as FortectIntego to prevent reinstallation of the operating system. Below you will also find alternative ways for data recovery.

How to spot phishing emails and prevent malware infection

Email spam is among the most prominent methods for malware delivery. While the principle remains the same from many years ago, cybercriminals employ new techniques to make fake emails more believable and can obfuscate them from automatic scanners. For example, Gmail and other reputable email providers scan each of the received emails, put the suspicious ones in the Junk folder, and mark it as “Dangerous.” Despite these efforts, many users still believe that the warning is a false-positive and proceed with clicking on attachments or the embedded links.

As previously mentioned, BazarLoader virus authors exploit the most relevant topics, such as coronavirus pandemic or the typical scare tactics. Besides, since they often include a link to Google Docs, many users are more inclined to click on it. Nonetheless, it is also known that cybercriminals employ malicious documents. In such a case, by enabling content within an attachment (DOC, PDF, and similar formats), victims would immediately begin the infection process.

There are several experts' tips^[4] that could prevent the devastating infection from occurring:

• Never allow documents attached to emails to run macro function (“Allow Content”);
• Employ additional email protection solutions;
• Upload attachments to Virus Total or similar analysis tools;
• Watch out for suspicious sender address;
• Do not give into fear and click on links/files without examining them.

Keep in mind that the sender's address, buttons, links, and other attributes can be faked by skilled criminals, so the most important criteria here is not to rush things and practice extreme caution when dealing with unexpected emails.

BazarLoader malware removal steps 

It is important to note that BazarLoader malware removal is not the only payload that you have to eliminate from the system. As previously mentioned, the virus would also deliver ransomware as a secondary payload. And while the elimination process for it does not differ much than the other malware's, its consequences are much more sinister. All the pictures, music, videos, documents, and other personal files will be locked even after you fully remove BazarLoader and Ryuk from the computer.

If your files were encrypted and you have no backups, make a copy of the data for the possible solution in the future. Then, download and install SpyHunterCombo Cleaner, MalwarebytesMalwarebytes, or another reputable anti-malware and perform a full system scan – accesses Safe Mode if required. After getting rid of the BazarLoader virus and Ryuk ransomware, attempt to fix Windows system damage with FortectIntego repair tool. Finally, follow the data recovery instructions we provide below, although keep in mind that the success rate of retrieving data fully is relatively low.