Extracted

• • Target

    TDGxENRMCBkgkc.bat

  • Size

    1KB

  • MD5

    372223c90e92c1bd3333eb5175375d10

  • SHA1

    bb4892289f99f41a5a56e18db703149ea80040f6

  • SHA256

    7a2b6dcdba0158d583d37512ddcfe816d31124c3234498a5910dac141869ffdd

  • SHA512

    010a7cce6c6c91c3716ec3dadfabb534c65a2a9e07b429b42ac62b3bcce1748f69d998d46370c36e2dccdac8e393e7b1681dd0aa09102fa7e416fcb56f9c0c87

  Score

  10^/10

  bumblebee1411trojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Blocklisted process makes network request

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    pFTLNjSsgkkKZo.dll

  • Size

    878KB

  • MD5

    07b711458d0b4240267f7e47b50075d1

  • SHA1

    e2e9feb1b42562cb1f22685667f8299dcdf10042

  • SHA256

    42a63fe8c0d8f9c2fa090a69d85f5e5b35beef468b58912db56c78dcde79a929

  • SHA512

    68fe82b71fc8e063642653a57fd2fe5580c233f22a4b17b4e5fc95456c7c96cd23a389b614d8d225c33f174c376795e55ebb409159ed5473a4f5d005bd933434

  • SSDEEP

    24576:9IRXooWOMQ4569PPkHHPplBDVaYRxH6df30Ra2HN7:9I5XWOZw6hMnBlbamH6dc1N7

  Score

  10^/10

  bumblebee1411trojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Blocklisted process makes network request

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral3behavioral4

• • Target

    project details.lnk

  • Size

    995B

  • MD5

    df5a41f7e317853827d382e4571d0080

  • SHA1

    567a29d53d0ec6cdceef71ce3ae5b5c422a00035

  • SHA256

    608900fe841dcedc2dceae20834ed1d492fd0e7625be681c0f608cafe830bd1b

  • SHA512

    b827a09d0b26478b9c8219440e9492e02b618ee9685c2afd7895aed6fb0cc042287264581e1432577e48e7a01b33c97d77b8948aeef62b79d20e0785c8c4ca2b

  Score

  10^/10

  bumblebee1411trojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral5behavioral6