bumblebee | sample2

Sharing

Copy URL Twitter E-mail

General

Target
sample2
Size 2.3MB
Sample220414-sd17aagda7
SHA256 7fb70df5d535857b5c229254ec8274550cc3fe4ddbc0a78cdd98f3332c2629d8
MD5 993578523d3c64d02a4af460694f7cf0
SHA1 edecc2ef0c7a4ec9ed8d31c2cabb08631c91d081
SHA512 39ae0d968d9839bd66450bc01a6ae8d29345190f108f4e4172bd2138eca098494a175b22d9549f3947d3bf93552f8a86f607c02f15596df30720be8818f95e94
SSDEEP 49152:2te5uI3Oe4DiBqcWeyh7p4JumqBq7CdJywzqPGmTLBx:253YumB7Ch1mnB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bumblebee

Malware Config

Extracted

Family

bumblebee

45.147.229.23:443

Signatures

Bumblebee family
bumblebee

File Explorer

sample2

.dll 2.3MB

sample2

IMPHASH c2ec1263bf326d96226b545fd95cf154
SHA256 7fb70df5d535857b5c229254ec8274550cc3fe4ddbc0a78cdd98f3332c2629d8
MD5 993578523d3c64d02a4af460694f7cf0
SHA1 edecc2ef0c7a4ec9ed8d31c2cabb08631c91d081
SHA512 39ae0d968d9839bd66450bc01a6ae8d29345190f108f4e4172bd2138eca098494a175b22d9549f3947d3bf93552f8a86f607c02f15596df30720be8818f95e94
SSDEEP 49152:2te5uI3Oe4DiBqcWeyh7p4JumqBq7CdJywzqPGmTLBx:253YumB7Ch1mnB
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

1232456

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLocalTime GetProcAddress SystemTimeToFileTime GetModuleHandleW GetCurrentProcess Thread32Next Thread32First GetModuleHandleA OpenProcess LoadLibraryA VirtualProtectEx OpenThread GetStdHandle GetFileType WriteFile MultiByteToWideChar SwitchToFiber DeleteFiber CreateFiber WideCharToMultiByte ConvertFiberToThread ConvertThreadToFiber QueryPerformanceCounter GetTickCount GlobalMemoryStatus GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetSystemTime ReadFile GetModuleFileNameW SetFilePointer lstrlenA CreateFileW lstrcmpA VirtualAlloc HeapFree CreateFileA HeapReAlloc HeapAlloc GetFileSize GetProcessHeap VirtualQuery lstrcpyA Wow64DisableWow64FsRedirection ExpandEnvironmentStringsW Wow64RevertWow64FsRedirection GetWindowsDirectoryW LocalFree GlobalMemoryStatusEx VerifyVersionInfoW GetFileAttributesW LoadLibraryW Process32FirstW GetFullPathNameW GetCurrentDirectoryW SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FindFirstFileW SetEndOfFile HeapSize CreateIoCompletionPort TlsFree GetSystemTimeAsFileTime TlsGetValue SleepEx VerSetConditionMask DeleteCriticalSection CreateWaitableTimerA QueueUserAPC TlsAlloc TerminateThread CreateEventW PostQueuedCompletionStatus GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects EnterCriticalSection SetLastError VerifyVersionInfoA TlsSetValue SetWaitableTimer CreateEventA GetCurrentProcessId ExitProcess SetEvent GetLastError GetModuleHandleExA Sleep lstrcatA SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindNextFileA FindFirstFileExA FindClose GetTimeZoneInformation GetOEMCP IsValidCodePage OutputDebugStringW SetStdHandle SetFilePointerEx GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FileTimeToSystemTime GetACP WriteConsoleW SetConsoleCtrlHandler GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary RtlUnwindEx RaiseException RtlPcToFileHeader InterlockedFlushSList FormatMessageA InitializeSListHead GetCurrentThreadId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent CreateDirectoryA GetFileAttributesA GetModuleFileNameA CloseHandle CreateToolhelp32Snapshot WaitForSingleObject Process32NextW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW DecodePointer EncodePointer

user32

FindWindowW MessageBoxW GetUserObjectInformationW GetProcessWindowStation wsprintfW

advapi32

EnumServicesStatusExW LookupPrivilegeValueA DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CloseServiceHandle OpenSCManagerW RegCloseKey RegOpenKeyExW RegQueryValueExW CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam GetUserNameW

shell32

SHGetSpecialFolderPathW SHGetSpecialFolderPathA

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoSetProxyBlanket CoInitializeSecurity

oleaut32

VariantClear SysAllocString SysFreeString SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetLBound SafeArrayGetElement SafeArrayGetUBound VariantInit

mpr

WNetGetProviderNameW

iphlpapi

GetAdaptersInfo

ws2_32

ioctlsocket freeaddrinfo getsockopt WSARecv connect setsockopt getaddrinfo WSASocketW send WSASetLastError select WSASend recv WSAStartup WSAGetLastError closesocket WSACleanup

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertCloseStore CertOpenStore

shlwapi

StrStrIW StrCmpIW PathCombineW StrToIntA StrChrA

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

653KB

Virtual Size

653KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

127KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ