General
-
Target
bc5d785487fd7a84d5a7187aabd2e6d6.bin
-
Size
1.8MB
-
Sample
230123-ss9rzadh62
-
MD5
bc5d785487fd7a84d5a7187aabd2e6d6
-
SHA1
da67c853cf34ce7cfbaf7619d2bd7d36d2cf82d0
-
SHA256
b29b0f2a27ccbb9f12363a3dde1f2d2373fdc782232f4804f0abffbb8daf9d25
-
SHA512
7e748dac9aa91bc7e0170d6e2f80c1fc34d3c4a5d60c7ded0dcf87d2348a2a39a391a8175f110dab7226700111ccf0feb686f9b20034388979749cbf1b34a1a7
-
SSDEEP
49152:yyGZT3ar6EpMHjvDg7QJXHoqwYh3ViDQ6yi:yNZTqrRn0YYh3ViDQ6y
Malware Config
Extracted
bumblebee
306a
104.168.164.153:443
193.27.14.242:443
146.70.53.183:443
51.68.146.200:443
146.70.78.21:443
185.62.56.12:443
146.19.253.15:443
160.20.147.191:443
79.110.52.236:443
37.72.174.23:443
64.44.135.230:443
103.175.16.108:443
146.70.106.83:443
185.62.56.224:443
103.175.16.106:443
154.56.0.223:443
103.175.16.38:443
104.168.204.123:443
103.144.139.18:443
51.68.147.233:443
Targets
-
-
Target
bc5d785487fd7a84d5a7187aabd2e6d6.bin
-
Size
1.8MB
-
MD5
bc5d785487fd7a84d5a7187aabd2e6d6
-
SHA1
da67c853cf34ce7cfbaf7619d2bd7d36d2cf82d0
-
SHA256
b29b0f2a27ccbb9f12363a3dde1f2d2373fdc782232f4804f0abffbb8daf9d25
-
SHA512
7e748dac9aa91bc7e0170d6e2f80c1fc34d3c4a5d60c7ded0dcf87d2348a2a39a391a8175f110dab7226700111ccf0feb686f9b20034388979749cbf1b34a1a7
-
SSDEEP
49152:yyGZT3ar6EpMHjvDg7QJXHoqwYh3ViDQ6yi:yNZTqrRn0YYh3ViDQ6y
Score10/10-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-