General
-
Target
bumble_out.dll
-
Size
1.0MB
-
Sample
220826-yb29fsggcr
-
MD5
bc0e627f4e46c8dcb659d3a0efd1da08
-
SHA1
78cc22d281f5342c145c79a3a7e3a3d9b3436486
-
SHA256
30473aa64d32098092e8a7df7300eb5728a4f8098944c80fc8afcf021033c941
-
SHA512
87617cea23bb9e3fa90fb8f440f9e9c94cd1049088b3b1a73b4fabbb39f351d68352b09427eda354f8080f8e972ad46322c54c7f656ea115ff4b37d4360a7e38
-
SSDEEP
24576:PypQl0cbcgxyhtSNT53d+nPodJ9Zx/dGEgyacTUYhZGpvf4u:/0g4tET53d8PoX9Zx/FxacTUwGp
Behavioral task
behavioral1
Sample
bumble_out.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bumble_out.dll
Resource
win10v2004-20220812-en
Malware Config
Extracted
bumblebee
2508
37.120.178.41:208
238.182.51.147:424
189.148.89.112:315
244.253.130.189:143
226.243.12.207:198
157.149.241.191:466
77.217.252.19:303
23.19.227.76:443
16.243.26.108:143
85.141.16.65:465
51.68.147.63:443
166.143.247.8:233
81.233.54.96:286
57.183.17.199:360
222.122.78.208:477
22.190.29.153:147
87.189.135.205:284
101.38.73.132:376
179.71.70.11:344
83.241.205.124:148
199.166.149.217:382
237.229.148.138:445
29.246.33.192:204
195.128.154.248:424
48.177.198.34:139
161.207.147.21:346
255.29.153.245:188
89.218.182.49:336
159.76.236.249:141
18.108.71.49:362
250.74.78.199:413
87.26.159.157:207
34.245.143.14:131
82.5.163.107:354
3.160.110.35:337
122.14.75.193:336
109.126.150.15:402
106.105.127.141:460
247.9.67.16:314
40.193.127.162:155
231.21.78.137:399
195.246.186.69:307
103.181.212.59:380
40.95.158.192:201
8.135.59.156:181
37.120.198.225:443
139.28.58.175:491
143.208.75.105:251
76.109.224.170:216
218.194.132.58:345
153.150.114.138:175
47.155.30.255:289
86.38.127.247:191
Targets
-
-
Target
bumble_out.dll
-
Size
1.0MB
-
MD5
bc0e627f4e46c8dcb659d3a0efd1da08
-
SHA1
78cc22d281f5342c145c79a3a7e3a3d9b3436486
-
SHA256
30473aa64d32098092e8a7df7300eb5728a4f8098944c80fc8afcf021033c941
-
SHA512
87617cea23bb9e3fa90fb8f440f9e9c94cd1049088b3b1a73b4fabbb39f351d68352b09427eda354f8080f8e972ad46322c54c7f656ea115ff4b37d4360a7e38
-
SSDEEP
24576:PypQl0cbcgxyhtSNT53d+nPodJ9Zx/dGEgyacTUYhZGpvf4u:/0g4tET53d8PoX9Zx/FxacTUwGp
Score5/10-
Suspicious use of NtCreateThreadExHideFromDebugger
-