General
-
Target
bumblebee.zip
-
Size
980KB
-
Sample
220623-ftkg9abgcp
-
MD5
f97984500b4a83cb6833aa1b86987683
-
SHA1
7d1895ce19f54e8ed14eb99fe60ea6dc441dd92a
-
SHA256
c124a8541d660881e81ae30a9500f852fc250e200a94966623cb8ed41185da02
-
SHA512
858582335558b0562e64f68306c273f54c6429724cd18e1a5985530195e05c23f628c17c9e3e7ca9a610005b9bf82a91be37cf7882f54ea21626ea240ffb0424
Malware Config
Extracted
bumblebee
2006r
149.4.32.76:241
194.104.136.152:443
119.230.89.42:407
45.153.241.234:443
173.45.237.73:444
169.239.191.195:335
173.107.248.213:137
90.108.111.212:276
146.19.173.105:443
216.4.65.112:354
52.6.247.44:324
162.212.72.241:135
114.188.145.216:303
5.109.171.105:392
142.11.216.143:443
87.144.64.172:286
103.250.125.252:491
117.173.171.58:296
157.2.47.226:120
53.50.204.254:356
Targets
-
-
Target
run.bat
-
Size
55B
-
MD5
a1f1828b9e47c0b8f9356ecd1b2da2b3
-
SHA1
fdd51793c3971be7eef45b22602e834e5c39b761
-
SHA256
0c5470714540792b882266e2267a7c883a1a22b736ad734c54adf8e8a83b07f4
-
SHA512
248b1036c88559eb07ada7376b3679130f8021f852bbcd79ffb9972c87cbb1ad7bbfe41f1444249335175d47f89ad27a87cd05a3dc9c832c9a5bb75080adb5d9
Score10/10-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-