bumblebee | 1_Attachments

Sharing

Copy URL Twitter E-mail

General

Target
1_Attachments
Size 2.2MB
Sample220414-sdnk7adbdl
SHA256 9fd92b2633147d58a5d4a28d1f5f66a11873c4185c44429295cda9956defa6d4
MD5 555b77d23549e231c8d7f0b003cc5164
SHA1 afde458ab0294f206a5cf832ce4e73661b0308f8
SHA512 a2d918e62fa320e73649099d3e15aa9790b39e878c965487e4621d5851d3d867f3b650470849e5518b40f99db0cbf9030807df59b476db266e5ae21b48d65384
SSDEEP 49152:wACKBYY7RFBiT6EdtaKBrTUR88VKIMUqPGZZNyc:/F4aKuR88lMU1Zzyc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bumblebee

Malware Config

Extracted

Family

bumblebee

23.82.19.208:443

Signatures

Bumblebee family
bumblebee

File Explorer

1_Attachments

.dll 2.2MB

1_Attachments

IMPHASH bc1fc12dfcfbfb96d61fc1ad211049f7
SHA256 9fd92b2633147d58a5d4a28d1f5f66a11873c4185c44429295cda9956defa6d4
MD5 555b77d23549e231c8d7f0b003cc5164
SHA1 afde458ab0294f206a5cf832ce4e73661b0308f8
SHA512 a2d918e62fa320e73649099d3e15aa9790b39e878c965487e4621d5851d3d867f3b650470849e5518b40f99db0cbf9030807df59b476db266e5ae21b48d65384
SSDEEP 49152:wACKBYY7RFBiT6EdtaKBrTUR88VKIMUqPGZZNyc:/F4aKuR88lMU1Zzyc
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

1213416

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

TlsAlloc QueueUserAPC CreateWaitableTimerA DeleteCriticalSection VerSetConditionMask SleepEx TlsGetValue GetSystemTimeAsFileTime TlsFree CreateIoCompletionPort FileTimeToSystemTime LoadLibraryW GetLocalTime GetProcAddress SystemTimeToFileTime GetModuleHandleW GetCurrentProcess Thread32Next Thread32First GetModuleHandleA OpenProcess LoadLibraryA VirtualProtectEx OpenThread GetStdHandle GetFileType WriteFile MultiByteToWideChar SwitchToFiber DeleteFiber CreateFiber WideCharToMultiByte ConvertFiberToThread ConvertThreadToFiber QueryPerformanceCounter GetTickCount GlobalMemoryStatus GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetSystemTime ReadFile GetModuleFileNameW SetFilePointer lstrlenA CreateFileW lstrcmpA TerminateThread VirtualAlloc HeapFree CreateFileA HeapReAlloc HeapAlloc GetFileSize GetProcessHeap VirtualQuery lstrcpyA GetFullPathNameW GetCurrentDirectoryW SystemTimeToTzSpecificLocalTime PeekNamedPipe SetEvent CreateEventW PostQueuedCompletionStatus GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects EnterCriticalSection SetLastError VerifyVersionInfoA TlsSetValue SetWaitableTimer GetCurrentProcessId ExitProcess GetLastError GetModuleHandleExA Sleep lstrcatA GetModuleFileNameA GetDriveTypeW FindFirstFileW SetEndOfFile HeapSize SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindNextFileA FindFirstFileExA FindClose GetTimeZoneInformation OutputDebugStringW SetStdHandle SetFilePointerEx GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP WriteConsoleW SetConsoleCtrlHandler GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary CreateDirectoryA GetFileAttributesA CloseHandle CreateToolhelp32Snapshot WaitForSingleObject RtlUnwindEx RaiseException RtlPcToFileHeader InterlockedFlushSList EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId InitializeSListHead FormatMessageA LocalFree

user32

GetUserObjectInformationW GetProcessWindowStation wsprintfW MessageBoxW

advapi32

CryptDecrypt LookupPrivilegeValueA DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash GetUserNameW CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey

shell32

SHGetSpecialFolderPathA

ole32

CoUninitialize CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoCreateInstance

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

ws2_32

WSASocketW getaddrinfo connect WSARecv getsockopt freeaddrinfo WSASetLastError setsockopt WSAGetLastError recv send select WSASend closesocket ioctlsocket WSACleanup WSAStartup

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertOpenStore CertGetCertificateContextProperty

shlwapi

StrChrA StrToIntA

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

640KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

124KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ