General
-
Target
bumblebee_mem.dll
-
Size
1.0MB
-
Sample
220831-w6wdaaaahr
-
MD5
d94d97088907942eab80e9d721cc74d4
-
SHA1
d30a5e340ca879ec6f523246a37c07c8292636e3
-
SHA256
27eec32524f00af06cd618a775ef6510ca6d53ab56a9ca5fa7f1d79674be9d1f
-
SHA512
6898ab5edf3fe5fd798f9922b4ab79cb0a57bbffd4e91b1e0e770c4d0783514cdfe0bd57f2c0955c686e423495a4c57b5bd5aafb87e74a21cdaf2cf92082fff2
-
SSDEEP
24576:cx2ubccfCEN1Wpv9hOQn7G9Zx/tGggFQhrxtxcZqeoc:kTCyWN9QQnq9Zx/ZgShrxtyqeo
Behavioral task
behavioral1
Sample
bumblebee_mem.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bumblebee_mem.dll
Resource
win10v2004-20220812-en
Malware Config
Extracted
bumblebee
2908
128.98.74.129:220
167.169.225.214:463
142.128.98.83:421
34.182.83.26:470
49.225.188.194:449
45.171.223.102:251
142.11.234.228:443
98.160.3.143:406
232.117.230.254:371
39.201.79.163:353
50.1.178.221:428
245.183.66.60:335
97.194.181.176:318
172.80.163.136:132
213.31.23.49:216
233.146.166.77:443
100.142.128.17:395
2.217.33.138:456
49.72.69.11:492
7.251.149.254:456
240.137.10.70:267
235.85.216.180:305
6.137.61.126:395
137.116.195.64:120
19.206.185.12:328
254.46.145.102:178
5.158.114.225:341
51.68.145.40:443
197.171.33.68:264
201.228.73.197:139
176.251.87.89:296
88.250.227.117:200
173.74.144.53:300
164.100.113.255:463
140.126.70.175:409
19.176.182.115:412
103.240.38.137:389
243.134.27.88:236
81.13.97.222:313
76.150.120.131:386
142.11.234.230:443
238.61.176.237:234
89.33.23.133:147
161.106.1.164:272
239.115.190.133:493
67.222.38.117:103
127.237.224.223:478
65.71.45.164:468
103.174.203.112:192
204.64.63.80:148
195.215.121.198:369
106.210.245.33:154
208.73.107.228:323
Targets
-
-
Target
bumblebee_mem.dll
-
Size
1.0MB
-
MD5
d94d97088907942eab80e9d721cc74d4
-
SHA1
d30a5e340ca879ec6f523246a37c07c8292636e3
-
SHA256
27eec32524f00af06cd618a775ef6510ca6d53ab56a9ca5fa7f1d79674be9d1f
-
SHA512
6898ab5edf3fe5fd798f9922b4ab79cb0a57bbffd4e91b1e0e770c4d0783514cdfe0bd57f2c0955c686e423495a4c57b5bd5aafb87e74a21cdaf2cf92082fff2
-
SSDEEP
24576:cx2ubccfCEN1Wpv9hOQn7G9Zx/tGggFQhrxtxcZqeoc:kTCyWN9QQnq9Zx/ZgShrxtyqeo
Score5/10-
Suspicious use of NtCreateThreadExHideFromDebugger
-