Overview

overview

10

Static

static

information.dll

windows7_x64

10

information.dll

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    information.dll
  • Size 2.0MB
  • Sample220616-tng2tsfhfl
  • SHA256 fed9bc8df9141f8f8f7a9203bc26b5b22123c154702fcd625379f2f7ecd31cb2
  • MD5 SHA1 SHA512
Score
10/10
bumblebee146levasiontrojan

Malware Config

Extracted

Family

  • bumblebee

Botnet

  • 146l

C2

  • 242.165.212.79:339

  • 162.144.249.150:239

  • 63.122.120.151:268

  • 144.52.138.51:193

  • 18.215.29.142:436

  • 115.239.67.202:380

  • 255.11.235.99:426

  • 213.203.201.199:307

  • 143.117.20.123:425

  • 141.98.168.70:443

  • 174.150.214.40:426

  • 133.133.249.24:204

  • 126.68.7.249:422

  • 103.175.16.107:443

  • 146.70.124.77:443

  • 154.56.0.100:443

  • 180.184.129.160:223

  • 28.78.74.145:427

  • 108.28.254.44:399

  • 115.103.22.1:153

rc4.plain

Targets

    • Target
      information.dll
    • Size 2.0MB
    • SHA256 fed9bc8df9141f8f8f7a9203bc26b5b22123c154702fcd625379f2f7ecd31cb2
    • MD5 SHA1 SHA512
    Score
    10/10
    bumblebee146levasiontrojan

    • BumbleBee

      BumbleBee is a webshell malware written in C++.

      trojanbumblebee

    • Enumerates VirtualBox registry keys

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks