Overview

overview

10

Static

static

vEzFDEkEeKmEBW.dll

windows7-x64

10

vEzFDEkEeKmEBW.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vEzFDEkEeKmEBW.dll.exe

  • Size

    2.2MB

  • Sample

    221101-fztywagda7

  • MD5

    672ef9a2359f36e0a9dcb0227944beeb

  • SHA1

    0d3e1b517781983f7b58e7b6b83384e83e8eb640

  • SHA256

    8e35ce0c3fcdc14d4e441812c7856bdf6428734d8cea0b6d7c075963a5b4b307

  • SHA512

    cb0b3d497805e25187d1b411c677f4a84180b25a9f08ffb241e2731515537a980db2215b53e22f7db872e3b79b30b4a3615ece2a5127c075c2a5b1d205774dc8

  • SSDEEP

    49152:+lU8yggsqIDwKXtjC+Nc1zQE5eFCUhVI/VocWPR5/rr23feAH/:8OLspjV1C3/VolfTrKeAf

Score
10/10
bumblebee2710vmtrojan

Malware Config

Extracted

Family

bumblebee

Botnet

2710vm

C2

23.106.160.141:443

198.98.56.242:443

104.244.77.61:443
rc4.plain

Targets

    • Target

      vEzFDEkEeKmEBW.dll.exe

    • Size

      2.2MB

    • MD5

      672ef9a2359f36e0a9dcb0227944beeb

    • SHA1

      0d3e1b517781983f7b58e7b6b83384e83e8eb640

    • SHA256

      8e35ce0c3fcdc14d4e441812c7856bdf6428734d8cea0b6d7c075963a5b4b307

    • SHA512

      cb0b3d497805e25187d1b411c677f4a84180b25a9f08ffb241e2731515537a980db2215b53e22f7db872e3b79b30b4a3615ece2a5127c075c2a5b1d205774dc8

    • SSDEEP

      49152:+lU8yggsqIDwKXtjC+Nc1zQE5eFCUhVI/VocWPR5/rr23feAH/:8OLspjV1C3/VolfTrKeAf

    Score
    10/10
    bumblebee2710vmtrojan

    • BumbleBee

      BumbleBee is a webshell malware written in C++.

      trojanbumblebee

    • Blocklisted process makes network request

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks