General
-
Target
bumble_out.dll
-
Size
1.0MB
-
Sample
220830-rmjsxsbfe9
-
MD5
498cfa2d40691fd9568894b2b4f1b641
-
SHA1
94c5b82021bfa2f37da9c5962b2d1424b957abf6
-
SHA256
742eb17996693fc26101f4365ff623beae22b3447e0e5232ee27b6772c2cb7b6
-
SHA512
666b77c92ad43d4a221aa30c633bd89a0f0c79b1bb2a36055839c5891ec686d5bff94914624e3c9b5faece08c9381d4f7dfe3403eeb48b25adefa27f6f7257cb
-
SSDEEP
24576:cx2ubccfCEN1Wpv9hOQn7G9Zx/tGggFQhrxtxcZqeoY:kTCyWN9QQnq9Zx/ZgShrxtyqeo
Behavioral task
behavioral1
Sample
bumble_out.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bumble_out.dll
Resource
win10v2004-20220812-en
Malware Config
Extracted
bumblebee
2908
49.90.128.0:259
82.164.203.153:390
226.103.15.6:476
204.63.46.16:298
134.66.180.254:397
172.239.204.162:211
151.12.102.30:408
127.163.249.9:278
161.124.131.243:153
230.158.249.130:364
37.176.144.6:127
33.86.39.162:247
129.35.138.157:129
4.211.195.124:422
96.187.65.205:397
19.206.185.249:302
46.63.248.114:321
238.8.10.238:407
169.114.71.135:178
142.11.234.228:443
119.83.73.136:382
22.143.49.205:450
147.141.15.0:173
163.193.222.130:415
240.246.225.75:305
169.16.87.11:222
128.128.251.228:348
188.73.188.42:245
155.137.8.60:376
103.172.189.145:287
231.48.190.130:170
83.46.36.177:266
1.128.207.160:157
43.122.160.37:278
246.59.14.231:325
149.201.25.67:366
15.167.113.56:176
176.94.31.206:261
146.53.67.106:469
241.127.148.158:419
231.67.4.25:402
114.68.4.241:161
178.169.20.116:453
51.68.145.40:443
4.188.224.254:128
71.68.150.16:423
92.79.97.114:130
77.7.166.196:269
147.228.234.145:241
82.177.114.85:495
30.219.17.254:335
142.11.234.230:443
115.122.116.77:306
Targets
-
-
Target
bumble_out.dll
-
Size
1.0MB
-
MD5
498cfa2d40691fd9568894b2b4f1b641
-
SHA1
94c5b82021bfa2f37da9c5962b2d1424b957abf6
-
SHA256
742eb17996693fc26101f4365ff623beae22b3447e0e5232ee27b6772c2cb7b6
-
SHA512
666b77c92ad43d4a221aa30c633bd89a0f0c79b1bb2a36055839c5891ec686d5bff94914624e3c9b5faece08c9381d4f7dfe3403eeb48b25adefa27f6f7257cb
-
SSDEEP
24576:cx2ubccfCEN1Wpv9hOQn7G9Zx/tGggFQhrxtxcZqeoY:kTCyWN9QQnq9Zx/ZgShrxtyqeo
Score5/10-
Suspicious use of NtCreateThreadExHideFromDebugger
-