Overview

overview

10

Static

static

oFWkRTFwjm.zip

windows10_x64

4

oFWkRTFwjm.zip

windows10-2004_x64

1

document.iso

windows10_x64

3

document.iso

windows10-2004_x64

3

documents.lnk

windows10_x64

10

documents.lnk

windows10-2004_x64

10

lipes.dll

windows10_x64

lipes.dll

windows10-2004_x64

Resubmissions

10-10-2022 17:13

221010-vrjkhacggj 10

03-06-2022 21:56

220603-1tra1seah3 1

03-06-2022 21:55

220603-1swt4sabgp 1

03-06-2022 21:38

220603-1hbq7adhf4 10

03-06-2022 21:28

220603-1brttsdha7 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    oFWkRTFwjm.zip

  • Size

    1.9MB

  • Sample

    220603-1brttsdha7

  • MD5

    972038d369ec6f134fc9b6c617adc328

  • SHA1

    0b74896a84f8e22645d8518135836ea22ae98cde

  • SHA256

    d184c7fac35e68924cf520d33fabc0703198756e096592dd31eec6101b5551e5

  • SHA512

    6ffeefd8c13785500a546e114cd766c8a2b804723511e2bb5ebeca1c5bfe44349b8c91695ac97bcf2da2d77c01530247f771655b132c649fdd9e00e710b4d8af

Score
10/10
bumblebee106revasiontrojan

Malware Config

Extracted

Family

bumblebee

Botnet

106r

C2

144.19.20.11:443

150.27.81.2:443

46.21.153.145:443

109.45.29.202:443

6.30.139.246:443

236.110.58.103:443

36.110.58.103:443

149.255.35.134:443

9.63.15.101:443

45.147.229.50:443

184.23.74.168:443

139.24.56.111:443

243.45.135.100:443

21.246.85.34:443

79.44.167.23:443

30.17.4.146:443

56.134.87.45:443

16.46.4.333:443

224.145.6.33:443
rc4.plain

Targets

    • Target

      oFWkRTFwjm.zip

    • Size

      1.9MB

    • MD5

      972038d369ec6f134fc9b6c617adc328

    • SHA1

      0b74896a84f8e22645d8518135836ea22ae98cde

    • SHA256

      d184c7fac35e68924cf520d33fabc0703198756e096592dd31eec6101b5551e5

    • SHA512

      6ffeefd8c13785500a546e114cd766c8a2b804723511e2bb5ebeca1c5bfe44349b8c91695ac97bcf2da2d77c01530247f771655b132c649fdd9e00e710b4d8af

    Score
    4/10
    behavioral1behavioral2

    • Target

      document.iso

    • Size

      2.9MB

    • MD5

      f85b9913ed3c1b37defe3a83c9107ae9

    • SHA1

      bd8732ac09eb363102cf8e3060869e7799c6afb5

    • SHA256

      6daa6a247d6989fe4723a1d0868ed4abb6dfaadf09d1177fa23856b841e00644

    • SHA512

      eed53b0bfc761259edb05ebcbb53c8e603ccdba33888a550671d60a9c2747f543b0d5c0a9d8cbc30bea7d20b872b72be1c621a5f58a18dae9dfe4eb27a79522a

    Score
    3/10
    behavioral3behavioral4

    • Target

      documents.lnk

    • Size

      1KB

    • MD5

      dcfc03467dc198612184a307837073d0

    • SHA1

      1fc2d8047e27d14e91c1061a07cc77fd8404747b

    • SHA256

      23e0f3debe5e378bd4ca50ee5243ec67f979ab66507b8ca97310c94706901c4a

    • SHA512

      97ba6aab3917be2da603cc7c9fd629dea478c13b7947400d2bf9bba6676e41b04b5588dc61ee9d39a2121d427bf2a602117fbec0d7071109be69333afbea1afa

    Score
    10/10
    bumblebee106revasiontrojan

    • BumbleBee

      BumbleBee is a webshell malware written in C++.

      trojanbumblebee

    • Enumerates VirtualBox registry keys

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion
    behavioral5behavioral6

    • Target

      lipes.dll

    • Size

      1.5MB

    • MD5

      9ef37bfa9f7e30500ad9edf136ee59d1

    • SHA1

      7b31d4ec43c65666f2e08bb73ec7877cf74d34a0

    • SHA256

      a1040e1d6b43eda731179d139f76949afb962b8cb28c55f4097cf5a5c6c445c1

    • SHA512

      1a52c2bb2775476a14220f79483582b5b09a310fcc5b017df8482ad3e5a0fb6438e28ae23da4cc76e6f05972ccec0d077065dcbd8d8d219d5897250ce38393bd

    Score
    1/10
    behavioral7behavioral8

MITRE ATT&CK Enterprise v6

Tasks