Skip to content
MalwareWiki

Malware

BazarBackdoor

aka BEERBOT · KEGTAP · Team9Backdoor · bazaloader · bazarloader

BazarBackdoor is a small backdoor, probably by a TrickBot "spin-off" like anchor.

BazarBackdoor, also known as BEERBOT, KEGTAP, Team9Backdoor, bazaloader, is a Windows malware family operated by UNC1878.

Background

BazarBackdoor is a compact backdoor likely produced by a TrickBot "spin-off" in the vein of anchor. It is referred to as the team9 backdoor, with its loader called the team9 restart loader.

At present it relies solely on Emercoin domains (.bazar), which is where its name comes from. FireEye labels BazarLoader as KEGTAP and BazarBackdoor as BEERBOT.

Source: Malpedia (Fraunhofer FKIE).