Overview

overview

10

Static

static

1

network.dll

windows7-x64

10

network.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    network.dll

  • Size

    1.0MB

  • Sample

    230218-q5kx9sbg7t

  • MD5

    fb98aec6e04559be2d5ff6e1b7dc5260

  • SHA1

    b83066ae84db1df91ede9fc323ca696085f378f2

  • SHA256

    c181c20d4efe8312d3d6a4de770febe8f48c92e78a4f7dfa7d011bba58ad8b67

  • SHA512

    17dd94fd6f4fc9d1f3444c54516ce5daca5f2ecd306222270fcab01a1abc9e01247732dce9b3afdd813491d3b0f969cad2cbb080cc02eb09f025e9de48186a5c

  • SSDEEP

    24576:ZgqqFfeeOby7LSjsfIMLkC8Jsc0Q+8VC7skZ:NqFVLIsActoC

Score
10/10
bumblebee132lgtrojan

Malware Config

Extracted

Family

bumblebee

Botnet

132lg

C2

205.185.113.34:443

103.144.139.146:443

23.106.223.222:443

95.168.191.248:443

23.106.223.182:443

146.70.29.237:443
rc4.plain

Targets

    • Target

      network.dll

    • Size

      1.0MB

    • MD5

      fb98aec6e04559be2d5ff6e1b7dc5260

    • SHA1

      b83066ae84db1df91ede9fc323ca696085f378f2

    • SHA256

      c181c20d4efe8312d3d6a4de770febe8f48c92e78a4f7dfa7d011bba58ad8b67

    • SHA512

      17dd94fd6f4fc9d1f3444c54516ce5daca5f2ecd306222270fcab01a1abc9e01247732dce9b3afdd813491d3b0f969cad2cbb080cc02eb09f025e9de48186a5c

    • SSDEEP

      24576:ZgqqFfeeOby7LSjsfIMLkC8Jsc0Q+8VC7skZ:NqFVLIsActoC

    Score
    10/10
    bumblebee132lgtrojan

    • BumbleBee

      BumbleBee is a webshell malware written in C++.

      trojanbumblebee

    • Blocklisted process makes network request

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks