bumblebee | sample0Fixed[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
sample0Fixed.bin
Size 1.1MB
Sample220622-jqlspadfb7
SHA256 2dc964be245c9a31a3dcee6e25b6e997e6a0cb7c3e93b00cb586f487a9ac7721
MD5 900cdb493f6781adc67292366f84c2dc
SHA1 a9e3dcbd16f8ab61101f397e39fdfb9439e9aa03
SHA512 e36c841ba0a9d2b101a7ef97259b236925d3ebe001f85d4cd6bddd5fde31c57bdfedf37f9faf442426e2b09f5316c7c70f1279f8a2d5e9d3232516d0c00666b9
SSDEEP 12288:oCJfbRc5MsQhJhzogN7XiOBIoh0uh2RzzJ79uI6vFamPCNRDLzTMKWiGoemors0l:oCJf+5Mz1oo7KokEIfmPeDLzTvxGPrs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

6a bumblebee

Malware Config

Extracted

Family

bumblebee

Botnet

146.19.253.15:443
160.20.147.191:443
79.110.52.236:443

rc4.plain

Signatures

Bumblebee family
bumblebee

File Explorer

sample0Fixed.bin

.dll 1.1MB

sample0Fixed.bin

IMPHASH 00b1bc1f0a0db461b47660df1defd1d0
SHA256 2dc964be245c9a31a3dcee6e25b6e997e6a0cb7c3e93b00cb586f487a9ac7721
MD5 900cdb493f6781adc67292366f84c2dc
SHA1 a9e3dcbd16f8ab61101f397e39fdfb9439e9aa03
SHA512 e36c841ba0a9d2b101a7ef97259b236925d3ebe001f85d4cd6bddd5fde31c57bdfedf37f9faf442426e2b09f5316c7c70f1279f8a2d5e9d3232516d0c00666b9
SSDEEP 12288:oCJfbRc5MsQhJhzogN7XiOBIoh0uh2RzzJ79uI6vFamPCNRDLzTMKWiGoemors0l:oCJf+5Mz1oo7KokEIfmPeDLzTvxGPrs
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

481368

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CertVerifyCertificateChainPolicy CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertCreateCertificateChainEngine

secur32

InitSecurityInterfaceA

kernel32

SetEvent TerminateThread GetCurrentProcessId CreateEventA SetWaitableTimer TlsSetValue VerifyVersionInfoA SetLastError EnterCriticalSection WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetQueuedCompletionStatus PostQueuedCompletionStatus CreateEventW FormatMessageW TlsAlloc QueueUserAPC CreateWaitableTimerA LocalFree DeleteCriticalSection VerSetConditionMask WideCharToMultiByte SleepEx TlsGetValue TlsFree FormatMessageA CreateIoCompletionPort AreFileApisANSI ReadFile SetHandleInformation CreateNamedPipeA WriteFile TerminateProcess GetCurrentThreadId GetSystemDirectoryW MultiByteToWideChar CreateFileA GetEnvironmentStrings CreateProcessA FreeEnvironmentStringsA GetExitCodeProcess FileTimeToSystemTime LoadLibraryW GetLocalTime GetProcAddress SystemTimeToFileTime GetModuleHandleW GetCurrentProcess Thread32Next Thread32First GetModuleHandleA LoadLibraryA VirtualProtectEx OpenThread GetModuleFileNameW SetFilePointer lstrlenA CreateFileW lstrcmpA VirtualAlloc HeapFree GetLastError HeapAlloc GetProcessHeap VirtualQuery lstrcpyA Wow64DisableWow64FsRedirection ExpandEnvironmentStringsW Wow64RevertWow64FsRedirection GetWindowsDirectoryW GetCurrentDirectoryW GlobalMemoryStatusEx VerifyVersionInfoW GetFileAttributesW Process32NextW Process32FirstW GetStdHandle RtlCaptureContext WaitForSingleObjectEx ResetEvent SetFilePointerEx HeapSize GetConsoleMode Sleep lstrcatA GetFileAttributesA OpenProcess GetModuleFileNameA CloseHandle CreateToolhelp32Snapshot WaitForSingleObject GetCPInfo GetConsoleCP FlushFileBuffers SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileA GetLocaleInfoW LCMapStringW CompareStringW GetStringTypeW GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter RaiseException DecodePointer EncodePointer RtlPcToFileHeader RtlVirtualUnwind HeapReAlloc FindFirstFileExA FindClose GetTimeZoneInformation GetOEMCP IsValidCodePage OutputDebugStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW ExitProcess GetACP WriteConsoleW GetFileType GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary RtlUnwindEx InterlockedFlushSList InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry

user32

wsprintfW FindWindowW

advapi32

LookupPrivilegeValueA RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameW

shell32

SHGetSpecialFolderPathA SHGetSpecialFolderPathW

ole32

CoCreateInstance CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

SafeArrayGetUBound SafeArrayGetElement SafeArrayGetLBound SafeArrayUnaccessData SafeArrayAccessData SysFreeString SysAllocString VariantClear VariantInit

mpr

WNetGetProviderNameW

iphlpapi

GetAdaptersInfo

ws2_32

getaddrinfo WSASocketW WSASetLastError select WSAStartup WSAGetLastError setsockopt connect ioctlsocket freeaddrinfo getsockopt WSASend closesocket WSACleanup WSARecv

shlwapi

PathCombineW StrCmpIW StrChrA StrStrIW StrToIntA

Name

.text

Size

670KB

Virtual Size

669KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

282KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

75KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ