Overview

overview

10

Static

static

dd204ab6-b...80.dll

windows7-x64

3

dd204ab6-b...80.dll

windows10-2004-x64

1

file-ea1bb...23.lnk

windows7-x64

10

file-ea1bb...23.lnk

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    files.zip

  • Size

    2.8MB

  • Sample

    221013-a7h9fsadb4

  • MD5

    ea6bbeaec5f40a304d577dbc7d394849

  • SHA1

    47a5522634c414395590a46c07bd9d8a2a6bd335

  • SHA256

    a5f9fff484cdf95a86a88d94c45f69fae77bb92a996bcd1ffb5b01a182101036

  • SHA512

    293e246ffe7add94d5f5b2261ac95461b2407ed5dc79bc9bb2342dff0e27cf6070b32faceaab9a41bcbec84f746583474e69adf28405fbb2ef697e42bc0ceb23

  • SSDEEP

    49152:Z90jx1pP022lYAkvSIsdZz9ggyCOBB0QG/VeOaCSzqFL6E+omxvIkwE3KFiBV53S:L0Ngbktsdx+gpA0QUVeEP5j+pInE3Yy4

Score
10/10
bumblebee1010evasiontrojan

Malware Config

Extracted

Family

bumblebee

Botnet

1010

C2

51.83.250.153:443

194.135.33.40:443

185.145.97.141:443
rc4.plain

Targets

    • Target

      dd204ab6-b2ca-4f8c-8f6b-b70093a2ec80.Vpy

    • Size

      2.0MB

    • MD5

      442f4e07da9878d04b1ec48c1db92648

    • SHA1

      4cbba55450697ea6f9459623f4801cef0d7259ac

    • SHA256

      8d58bea19cc529526e670de83d3e3009d5e69447ca41d9c3d45013a3b683da83

    • SHA512

      857d8df09b37d57771f080490451f03832e1a42dc83fe7aa18fbda643c58e48371c11807e5a8a943060b3934b72d8ecb15b283b604a856f997ebfbe155ea442e

    • SSDEEP

      49152:hESQEiUQsu5LJvbqdpwKaeiSk6+OJyR8:PQ6SvvbqViSk67J88

    Score
    3/10
    behavioral1behavioral2

    • Target

      file-ea1bb905-6718-4e55-8cb2-4f2cfbf2cd23.lnk

    • Size

      1KB

    • MD5

      25804c14d838ee802da26c6c394059ff

    • SHA1

      8f9f2311b1962bbf2d433a419b5b6dd8c0788366

    • SHA256

      63f8f0291ea92dbb363dec39ec1b6ccfce854ea4f7abdb9b8a2907594d7dca32

    • SHA512

      484151f2d04ae782fe8fcacc09f33e31ae56dfaaa87e1d23e751651abb6ad4cf9f6d0f0f1377d30096ae822bd3222f8f196bd876871048f813409d76fcfea0ee

    Score
    10/10
    bumblebee1010evasiontrojan

    • BumbleBee

      BumbleBee is a webshell malware written in C++.

      trojanbumblebee

    • Enumerates VirtualBox registry keys

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

4
T1497

Credential Access

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

4
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks