Overview

overview

10

Static

static

projectr.dll

windows7_x64

10

projectr.dll

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    projectr.dll
  • Size 1.8MB
  • Sample220624-lpbx7secb7
  • SHA256 287055194e83ab2a8d91ef4d187de57345c19018cf3a85024c4fd20c64ad689e
  • MD5 SHA1 SHA512
Score
10/10
bumblebee236aevasiontrojan

Malware Config

Extracted

Family

  • bumblebee

Botnet

  • 236a

C2

  • 146.19.173.191:443

  • 205.218.26.106:335

  • 133.228.15.13:127

  • 60.3.192.137:146

  • 146.70.124.97:443

  • 40.178.16.145:137

  • 216.149.130.58:162

  • 121.214.140.226:358

  • 54.200.237.168:311

  • 85.217.238.89:286

  • 23.82.141.11:443

  • 135.49.247.231:357

  • 105.99.153.173:436

  • 226.179.144.85:474

  • 115.177.167.79:268

  • 23.29.115.172:443

  • 242.165.229.167:492

  • 238.78.243.167:401

  • 28.192.253.108:405

  • 82.217.32.8:253

rc4.plain

Targets

    • Target
      projectr.dll
    • Size 1.8MB
    • SHA256 287055194e83ab2a8d91ef4d187de57345c19018cf3a85024c4fd20c64ad689e
    • MD5 SHA1 SHA512
    Score
    10/10
    bumblebee236aevasiontrojan

    • BumbleBee

      BumbleBee is a webshell malware written in C++.

      trojanbumblebee

    • Enumerates VirtualBox registry keys

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks