bumblebee | 236c3fe0000[.]GdiPlus[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
236c3fe0000.GdiPlus.dll
Size 2.3MB
Sample220428-tyflrabgcj
SHA256 c0d1b25bd04fcaa5a4f76e868a9c3cfa2d51408eae2785c468887318b0f22bf0
MD5 c11b76d93f31d598ace8777f2d20a0d9
SHA1 4a33a5f1527af26b11fab7b8be6bedc250615691
SHA512 73bc7121abc4112bce6faeffd870c6b32cf9efa8ff998355e0b3c061fed9617bf9ad26290e59ac29a1703f5b590a0b60d5a7d2c955c5735029ee6d672c4b009c
SSDEEP 49152:pYFScC4wxc6u3V466dQPOtnCMBaOW9k5ocVUyHX3qPGZx7f9+b:lm9wsOWMVUk1ZVf9+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bumblebee

Malware Config

Extracted

Family

bumblebee

28.11.143.222:443
71.1.188.122:443
49.12.241.35:443
89.222.221.14:443
185.33.87.53:443
108.62.118.56:443

Signatures

Bumblebee family
bumblebee

File Explorer

236c3fe0000.GdiPlus.dll

.dll 2.3MB

236c3fe0000.GdiPlus.dll

IMPHASH 5afa82db0b2242a1687d8cf2e9fa7187
SHA256 c0d1b25bd04fcaa5a4f76e868a9c3cfa2d51408eae2785c468887318b0f22bf0
MD5 c11b76d93f31d598ace8777f2d20a0d9
SHA1 4a33a5f1527af26b11fab7b8be6bedc250615691
SHA512 73bc7121abc4112bce6faeffd870c6b32cf9efa8ff998355e0b3c061fed9617bf9ad26290e59ac29a1703f5b590a0b60d5a7d2c955c5735029ee6d672c4b009c
SSDEEP 49152:pYFScC4wxc6u3V466dQPOtnCMBaOW9k5ocVUyHX3qPGZx7f9+b:lm9wsOWMVUk1ZVf9+
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

1229048

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FileTimeToSystemTime LoadLibraryW GetLocalTime GetProcAddress SystemTimeToFileTime GetModuleHandleW GetCurrentProcess Thread32Next Thread32First GetModuleHandleA OpenProcess LoadLibraryA VirtualProtectEx OpenThread GetStdHandle GetFileType WriteFile MultiByteToWideChar SwitchToFiber DeleteFiber CreateFiber WideCharToMultiByte ConvertFiberToThread ConvertThreadToFiber QueryPerformanceCounter GetTickCount GlobalMemoryStatus GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetSystemTime ReadFile GetModuleFileNameW SetFilePointer lstrlenA CreateFileW lstrcmpA VirtualAlloc HeapFree CreateFileA HeapReAlloc HeapAlloc GetFileSize GetProcessHeap VirtualQuery lstrcpyA Wow64DisableWow64FsRedirection ExpandEnvironmentStringsW Wow64RevertWow64FsRedirection GetWindowsDirectoryW LocalFree GlobalMemoryStatusEx CreateIoCompletionPort GetSystemTimeAsFileTime Process32NextW Process32FirstW GetFullPathNameW GetCurrentDirectoryW SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FindFirstFileW SetEndOfFile HeapSize TlsGetValue SleepEx VerSetConditionMask DeleteCriticalSection CreateWaitableTimerA QueueUserAPC TlsAlloc TerminateThread CreateEventW PostQueuedCompletionStatus GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects EnterCriticalSection SetLastError VerifyVersionInfoA TlsSetValue SetWaitableTimer CreateEventA GetCurrentProcessId ExitProcess SetEvent GetLastError Sleep lstrcatA SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindNextFileA FindFirstFileExA FindClose GetTimeZoneInformation GetOEMCP IsValidCodePage OutputDebugStringW SetStdHandle SetFilePointerEx GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale VerifyVersionInfoW TlsFree GetACP WriteConsoleW SetConsoleCtrlHandler GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary RtlUnwindEx RaiseException RtlPcToFileHeader InterlockedFlushSList FormatMessageA InitializeSListHead GetCurrentThreadId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent CreateDirectoryA GetFileAttributesA GetModuleFileNameA CloseHandle CreateToolhelp32Snapshot WaitForSingleObject GetFileAttributesW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW DecodePointer EncodePointer

user32

FindWindowW MessageBoxW GetUserObjectInformationW GetProcessWindowStation wsprintfW

advapi32

LookupPrivilegeValueA DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey RegCloseKey RegOpenKeyExW RegQueryValueExW CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam GetUserNameW

shell32

SHGetSpecialFolderPathW SHGetSpecialFolderPathA

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoSetProxyBlanket CoInitializeSecurity

oleaut32

VariantClear SysAllocString SysFreeString SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetLBound SafeArrayGetElement SafeArrayGetUBound VariantInit

mpr

WNetGetProviderNameW

iphlpapi

GetAdaptersInfo

ws2_32

ioctlsocket freeaddrinfo getsockopt WSARecv connect setsockopt getaddrinfo WSASocketW send WSASetLastError select WSASend recv WSAStartup WSAGetLastError closesocket WSACleanup

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertCloseStore CertOpenStore

shlwapi

StrStrIW StrCmpIW PathCombineW StrToIntA StrChrA

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

651KB

Virtual Size

650KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

126KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ