BazarLoader malware: what it is and how to remove it

From our report of Oct 2020 · not reviewed since

More from our earlier report on BazarLoader malware

• To delete malware from your system, you should employ powerful security solutions.
• Access Safe Mode with Networking if the elimination process is unsuccessful in normal mode
• Malware can seriously tamper and change Windows system files, to the point where the OS might become hardly operational after malware elimination.
• Why i can't reach you on the phone?
• I am on my way to XXX.
• Because of customer complaint #7592 on you from last Friday, we will process termination process.
• here is the copy in PDF: Please call me back till i will process additional debit from your acc.

From our report of Oct 2020 · not reviewed since

BazarLoader is a malicious program categorized as a Trojan and a backdoor - it is designed to infiltrate Windows machines and grant the attackers secret access to them.

Once installed, the malware can perform various malicious functions, although the main purpose of the threat is to deliver other malware. While the final payload is not defined and can be literally anything, cybersecurity experts observed a deployment of Ryuk ransomware, which encrypts all personal files on all the computers connected to the network and then demands a ransom for the decryption tool.

BazarLoader malware has been used by the same cybercriminals who were actively spreading the infamous Trickbot Trojan, usually delivered via spam email campaigns. Phishing emails might be highly targeted or sent to random users and include various topics, including COVID-19 pandemic, business inquiries, fake customer complaint forms, etc.

The cybercriminal gang behind BazarLoader malware chose this malware due to its simplicity and increased obfuscation. Trickbot, which is considered one of the most prevalent Trojans in the world, has been analyzed by many leading security research groups, hence became much easier to detect and stop.

Despite this, many security solutions can detect and remove BazarLoader virus before it manages to cause any harm. One of the observed malicious email attachment samples (Print_Preview.exe) is detected as follows on Virus Total:

The initial attack of BazarLoader malware starts with a phishing email that is often highly targeted. Many security researchers that analyzed the campaign uncovered that most of the emails are presented as customer complaints. Here is one of the examples:

Since the link is directing to Google Docs, victims are more likely to proceed. Once the link is clicked, they are redirected to a web-based PDF document, which includes another link. This time, by clicking on it, users would begin the installation of the BazarLoader malware.

As soon as the infection process is complete, the virus will install the BazarBackdoor part of the payload, which would inject malicious components into legitimate Windows processes, such as cmd.exe, explorer.exe, and svchost.exe. During this time, a scheduled task is also established on the system for the malware to start with each Windows boot. After performing some more downloads, BazarLoader malware will finally deploy Ryuk ransomware.

Once that is complete, malicious actors can ask victims for high sums as ransoms (typically, 10 to 50 bitcoin - approx. $114k - $570k at the time of the writing) for data recovery. Thus, BazarLoader seems like a great choice for cybercriminals due to low detection rates, which also guarantees high profits due to the ransomware component within the campaign.

BazarLoader malware removal is not the hardest process as long as adequate security software (such as or ) is used, although the encrypted files or a data leak can be the most devastating side-effects of the infection. Below you will also find alternative ways for data recovery.

• Trojan.GenericKD.43838874
• Backdoor:Win64/Zarab!MSR
• Trojan.Trickster.Gen
• Win64:CrypterX-gen
• Win/malicious_confidence_100% (W)
• Trojan.Bazar
• A Variant Of Win64/Kryptik.CAK, etc.

From our report of Oct 2020 · not reviewed since

How to spot phishing emails and prevent malware infection

Email spam is among the most prominent methods for malware delivery.

While the principle remains the same from many years ago, cybercriminals employ new techniques to make fake emails more believable and can obfuscate them from automatic scanners.

For example, Gmail and other reputable email providers scan each of the received emails, put the suspicious ones in the Junk folder, and mark it as "Dangerous." Despite these efforts, many users still believe that the warning is a false-positive and proceed with clicking on attachments or the embedded links.

As previously mentioned, BazarLoader virus authors exploit the most relevant topics, such as coronavirus pandemic or the typical scare tactics. Besides, since they often include a link to Google Docs, many users are more inclined to click on it.

Nonetheless, it is also known that cybercriminals employ malicious documents. In such a case, by enabling content within an attachment (DOC, PDF, and similar formats), victims would immediately begin the infection process.

There are several experts' tips that could prevent the devastating infection from occurring:

Keep in mind that the sender's address, buttons, links, and other attributes can be faked by skilled criminals, so the most important criteria here is not to rush things and practice extreme caution when dealing with unexpected emails.

• Never allow documents attached to emails to run macro function ("Allow Content");
• Employ additional email protection solutions;
• Upload attachments to Virus Total or similar analysis tools;
• Watch out for suspicious sender address;
• Do not give into fear and click on links/files without examining them.

From our report of Oct 2020 · not reviewed since

BazarLoader malware removal steps

It is important to note that BazarLoader malware removal is not the only payload that you have to eliminate from the system.

As previously mentioned, the virus would also deliver ransomware as a secondary payload. And while the elimination process for it does not differ much than the other malware's, its consequences are much more sinister. All the pictures, music, videos, documents, and other personal files will be locked even after you fully remove BazarLoader and Ryuk from the computer.

If your files were encrypted and you have no backups, make a copy of the data for the possible solution in the future. Then, download and install , , or another reputable anti-malware and perform a full system scan - accesses Safe Mode if required. Finally, follow the data recovery instructions we provide below, although keep in mind that the success rate of retrieving data fully is relatively low.

[GI=method-1]Access Safe Mode with Networking if malware is tampering with your security tools:

[GI=method-2]System Restore can also be effective when trying to remove malicious programs:

Windows Previous Versions feature might be useful

In case malware failed to delete Shadow Copies, you can attempt to recover files one-by-one.

Take control of your files with ShadowExplorer

This tool can automate data recovery if Shadow Copies are still present on the PC.