bumblebee | 1d29af40000[.]GdiPlus[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
1d29af40000.GdiPlus.dll
Size 2.3MB
Sample220428-tx94zafbc7
SHA256 ec89e1c3eb2c04415b7f24bb65f32976f93ca264fb7bad95e7aa842f9b3135d6
MD5 66108c5d7e5f4e446991c370c908c00c
SHA1 530797112fbc9743c74f89e9993c1effd44a754a
SHA512 50340c70c6ddee5659164ce4e1ce64b4d4cb327c75a9ef26e4cd89f44194cd7fd43b0a6263e498f6ef38a0aa7878e977f06ccdf80f638a89144db73e0a43bdf4
SSDEEP 49152:K8p52bF0OG8HF1oq+Qj7UZk5kwSHZ6iqPG+NCza152L/i:fEUZdwSd1+Qza152L/i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bumblebee

Malware Config

Extracted

Family

bumblebee

199.80.55.44:443
209.141.59.96:443
23.106.160.120:443

Signatures

Bumblebee family
bumblebee

File Explorer

1d29af40000.GdiPlus.dll

.dll 2.3MB

1d29af40000.GdiPlus.dll

IMPHASH 0c8a802bd220e748d90d770ce28c4080
SHA256 ec89e1c3eb2c04415b7f24bb65f32976f93ca264fb7bad95e7aa842f9b3135d6
MD5 66108c5d7e5f4e446991c370c908c00c
SHA1 530797112fbc9743c74f89e9993c1effd44a754a
SHA512 50340c70c6ddee5659164ce4e1ce64b4d4cb327c75a9ef26e4cd89f44194cd7fd43b0a6263e498f6ef38a0aa7878e977f06ccdf80f638a89144db73e0a43bdf4
SSDEEP 49152:K8p52bF0OG8HF1oq+Qj7UZk5kwSHZ6iqPG+NCza152L/i:fEUZdwSd1+Qza152L/i
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

1230168

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FileTimeToSystemTime LoadLibraryW GetLocalTime GetProcAddress SystemTimeToFileTime GetModuleHandleW GetCurrentProcess Thread32Next Thread32First GetModuleHandleA OpenProcess LoadLibraryA VirtualProtectEx OpenThread GetStdHandle GetFileType WriteFile MultiByteToWideChar SwitchToFiber DeleteFiber CreateFiber WideCharToMultiByte ConvertFiberToThread ConvertThreadToFiber QueryPerformanceCounter GetTickCount GlobalMemoryStatus GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetSystemTime ReadFile GetModuleFileNameW SetFilePointer lstrlenA CreateFileW lstrcmpA VirtualAlloc HeapFree CreateFileA HeapReAlloc HeapAlloc GetFileSize GetProcessHeap VirtualQuery lstrcpyA Wow64DisableWow64FsRedirection ExpandEnvironmentStringsW Wow64RevertWow64FsRedirection GetWindowsDirectoryW LocalFree GlobalMemoryStatusEx CreateIoCompletionPort GetSystemTimeAsFileTime Process32NextW Process32FirstW GetFullPathNameW GetCurrentDirectoryW SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FindFirstFileW SetEndOfFile HeapSize TlsGetValue SleepEx VerSetConditionMask DeleteCriticalSection CreateWaitableTimerA QueueUserAPC TlsAlloc TerminateThread CreateEventW PostQueuedCompletionStatus GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects EnterCriticalSection SetLastError VerifyVersionInfoA TlsSetValue SetWaitableTimer CreateEventA GetCurrentProcessId ExitProcess SetEvent GetLastError GetModuleHandleExA Sleep lstrcatA SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindNextFileA FindFirstFileExA FindClose GetTimeZoneInformation GetOEMCP IsValidCodePage OutputDebugStringW SetStdHandle SetFilePointerEx GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale VerifyVersionInfoW TlsFree GetACP WriteConsoleW SetConsoleCtrlHandler GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary RtlUnwindEx RaiseException RtlPcToFileHeader InterlockedFlushSList FormatMessageA InitializeSListHead GetCurrentThreadId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent CreateDirectoryA GetFileAttributesA GetModuleFileNameA CloseHandle CreateToolhelp32Snapshot WaitForSingleObject GetFileAttributesW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW DecodePointer EncodePointer

user32

FindWindowW MessageBoxW GetUserObjectInformationW GetProcessWindowStation wsprintfW

advapi32

LookupPrivilegeValueA DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey RegCloseKey RegOpenKeyExW RegQueryValueExW CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam GetUserNameW

shell32

SHGetSpecialFolderPathW SHGetSpecialFolderPathA

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoSetProxyBlanket CoInitializeSecurity

oleaut32

VariantClear SysAllocString SysFreeString SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetLBound SafeArrayGetElement SafeArrayGetUBound VariantInit

mpr

WNetGetProviderNameW

iphlpapi

GetAdaptersInfo

ws2_32

ioctlsocket freeaddrinfo getsockopt WSARecv connect setsockopt getaddrinfo WSASocketW send WSASetLastError select WSASend recv WSAStartup WSAGetLastError closesocket WSACleanup

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertCloseStore CertOpenStore

shlwapi

StrStrIW StrCmpIW PathCombineW StrToIntA StrChrA

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

651KB

Virtual Size

650KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

127KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ