Overview

overview

10

Static

static

1

071808d3ef...6e.dll

windows7-x64

10

071808d3ef...6e.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    22c884dd78b0ab7f6c6c5eedd37a4e89.bin

  • Size

    826KB

  • Sample

    230210-bc5pmshe2s

  • MD5

    838f06eb92b2bcd1ff9475eba5de01cf

  • SHA1

    7105516dba98d937e94724b98c2c4d3ed3936849

  • SHA256

    4c70622cd8bc212dfbe31763713d6e93a490198f1b47ee2123a39051ade8e746

  • SHA512

    d359adef81239bacd9fb0055a085220322702a244348c3babd1d3eb2dbc2076dca6dd4e90b978201fd5ae2d6da8c3a2e629ed38eb6b86c1df3d802a77398a994

  • SSDEEP

    24576:lRpUjDKUmP9X/MplyI4S3XRn5Tw+pmffQvG:4WllUplyI4SHR5T/pQ4O

Score
10/10
bumblebee80223trojan

Malware Config

Extracted

Family

bumblebee

Botnet

80223

C2

205.185.113.34:443

172.86.120.111:443

23.254.167.63:443

103.175.16.104:443
rc4.plain

Targets

    • Target

      071808d3ef79b01ad8bab9ff9d031e66ddd89d61b973dd680c7e9a8362c1546e.exe

    • Size

      1.1MB

    • MD5

      22c884dd78b0ab7f6c6c5eedd37a4e89

    • SHA1

      4674e0c2a601d15c3dc6a9e273c77b93ee44796f

    • SHA256

      071808d3ef79b01ad8bab9ff9d031e66ddd89d61b973dd680c7e9a8362c1546e

    • SHA512

      b0f06d1956c36b1c03f03d9a3cc19eeff5071b974f7fcbce6a7f08225709b543efc4fd2829d5ebe461f13295b28df88680602c13470e9ad86314f0f839580a78

    • SSDEEP

      24576:/cgtVNEgRC+Bk1zJGa41QUF7BRQQRNEEEh9g7aEgxPNOa:ptzEmC+W114qUdgQXaiq

    Score
    10/10
    bumblebee80223trojan

    • BumbleBee

      BumbleBee is a webshell malware written in C++.

      trojanbumblebee

    • Blocklisted process makes network request

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks