Overview

overview

10

Static

static

run.bat

windows7-x64

1

run.bat

windows10-2004-x64

1

sample.dll

windows7-x64

10

sample.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bumblebee221102.zip

  • Size

    721KB

  • Sample

    221103-hq9zvafdc5

  • MD5

    780bab8e72b4084957420f6c6ee9e2e4

  • SHA1

    477e1514badded140a55ec22c34d337f0c5e159e

  • SHA256

    a02b9ce9695dcf224e04b683973559c18aa3a6df8154c38646c5abee8d074e6b

  • SHA512

    7d3de73a77e49cdfb6bcb6da4702df07e630b76334ce845d54cb0e90d627a2f1a0b5669683f02e1658dcb81447630bda54dddebb2789b670d17dd1829149a43a

  • SSDEEP

    12288:XfkuWgFosDWGcNHFtofXxa1PJUpiDJuJwOf84/Wyr9EfDKzQy0daj76J/kgk:vRWKOFFOa1P2EDJuJJ9rqEEdnJ/kgk

Score
10/10
bumblebee0211trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0211

C2

176.223.165.119:443

51.75.63.234:443

104.168.171.189:443
rc4.plain

Targets

    • Target

      run.bat

    • Size

      52B

    • MD5

      9b87a485cf8ab6c0d551bc4eb29f908c

    • SHA1

      03d57d461cd941a5a48e3caba5c56fa0f5c6ebde

    • SHA256

      d6f5a35673fc49905ac7d8b2b8be4303b9a6386c441fd9571df661299f398071

    • SHA512

      aea184ee1986f2ffbf8e1ef18c53ffb944968520d90c0377bcc853cf450aae456d713a623f2a87b8a7a0b20db414a9d5e25d4bb761ee05ae2f55003f4008d5bb

    Score
    1/10
    behavioral1behavioral2

    • Target

      sample.dll

    • Size

      1.4MB

    • MD5

      38445646abd11b843c2b89593082cd4b

    • SHA1

      46125264343b4ae45292c6186526ee1e46c2ffb6

    • SHA256

      225fbedd5ed8d93e78a59a60955a4ae7bbe11476668699b2dc2a189508d6f493

    • SHA512

      06985b3fb40781d1a0cf0c3a072f863141570b9e183dbd299f0a63889a9ee624c8de7342288e1f612580e5a439c41531ce14e27613f9f80f4e08e59a1f9eabc2

    • SSDEEP

      24576:30vmdBQqlXGM+68I31p2v1Gyc10yLhkr1:30vSBQqlWMf31S1yLhk

    Score
    10/10
    bumblebee0211trojan

    • BumbleBee

      BumbleBee is a webshell malware written in C++.

      trojanbumblebee

    • Blocklisted process makes network request

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral3behavioral4

MITRE ATT&CK Matrix

Tasks