Overview

overview

10

Static

static

Offer.lnk

windows7-x64

3

Offer.lnk

windows10-2004-x64

3

notrobassf...es.bat

windows7-x64

1

notrobassf...es.bat

windows10-2004-x64

1

notrobassf...ng.dll

windows7-x64

10

notrobassf...ng.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Downloads.7z

  • Size

    673KB

  • Sample

    221102-xnavasdehm

  • MD5

    321261cdb579752d3e59d8ec16273206

  • SHA1

    f7a565a408528fd99bfe2a5e2103bbc9acac4d6b

  • SHA256

    99482cc76a3f020bbca4609e4b4d39e3577543443898941b916079dc9b738fb3

  • SHA512

    97c474061b8e294414b5fbaf559ed11a1ab4aaec14535352917591fe3990c4a46411314198bc8b439f32e31c831df7c784d1b609d3882a15f5504c7ed1ae1757

  • SSDEEP

    12288:0yxSVJqWure1KutRi2HpTNKoupkPc6Kw1HtltDETmMIMn/BGFAQyAbt2:0vVEWuYu2H90pkrxDRRMF/BGa1AQ

Score
10/10
bumblebee0211rtrojan

Malware Config

Extracted

Family

bumblebee

Botnet

0211r

C2

193.109.120.156:443

192.111.146.184:443

104.219.233.113:443
rc4.plain

Targets

    • Target

      Offer.lnk

    • Size

      1KB

    • MD5

      df5f90b662e0ad2e52061ca89562284b

    • SHA1

      c08d3e8d7f02e170184425e78d5602613cbd2ecb

    • SHA256

      dea6d1eb9258bc14935feb2d42559809fc201e16699cc717a2c362e51bd52dff

    • SHA512

      083e9763c0a125bd284e255121fa0891c340cd2ee9e56a7b01dc56ae3e76268ee65708c0281ef00b15ce3ac22c5d502a2f95dfdb9c2c57929b65bad07e080517

    Score
    3/10
    behavioral1behavioral2

    • Target

      notrobassfir/colonelclothes.bat

    • Size

      1KB

    • MD5

      ccd8689373558c3bc18aa89994fde940

    • SHA1

      3b82acecef9a9b5c8c3b2343e1082a7a95baedcb

    • SHA256

      9bf48a2dfaa3acdbf45552a1bc73c7679ec754cd0d67b6936cfb88aa6130cb6b

    • SHA512

      a721d9ec1015c3d0558fd7eac4eb23a34877ac5aa0c2d629069a26afcd5eb7a50062a48ccb14dec0790735a4d20f91fe17dce46c02bacd0f30533f9d017e9ae1

    Score
    1/10
    behavioral3behavioral4

    • Target

      notrobassfir/imposing.dat

    • Size

      884KB

    • MD5

      f695e7d84ac6d462adc55118cda0c792

    • SHA1

      c70ecce2819cc317cba891580310d2d307fef0f2

    • SHA256

      033bb9e1fb03ff19cc9378bd90c6356213873491943d253acfb0ae6c46f18469

    • SHA512

      09511d94a4934c26a0d5789e27aa8fe6354a4246bca412111d595698dd305ed5c5f41ae9c8315e08545d2991751d67522bc4f41f1fd4c5fd933fe51a09485d2c

    • SSDEEP

      24576:TjwHkcqYk13VTnKisg1YJnFvbkE6FElPNoG:TjwHkcqLVTnJpYReRCXo

    Score
    10/10
    bumblebee0211rtrojan

    • BumbleBee

      BumbleBee is a webshell malware written in C++.

      trojanbumblebee

    • Blocklisted process makes network request

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral5behavioral6

MITRE ATT&CK Enterprise v6

Tasks