Overview

overview

10

Static

static

1

Contract_0...29.exe

windows7-x64

10

Contract_0...29.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Contract_02_21_Copy#29.exe

  • Size

    1.4MB

  • Sample

    230221-2lqvysag4z

  • MD5

    599378917c2d2a802c8c2063fac651c3

  • SHA1

    022c49842268d62e1956fc3dd67d6bbfb878844c

  • SHA256

    1c17ffd1b75481630244bb1f0f78b819798f900966210b0e3ca06276b38558f2

  • SHA512

    ba1eddcd059d9f322fa312365e28da0c56496033423c39736b71fd58623cd685253dc071de2c91a7f89094fa4196e4df91ef197664672903d835f579e034c8fb

  • SSDEEP

    24576:AArPuHyMNjmtUwvd1HFG74s54663DxFxxqQQGAj/uuf9:ARHyqjGUydzC4cFItwkW

Score
10/10
bumblebee21macatrojan

Malware Config

Extracted

Family

bumblebee

Botnet

21maca

C2

108.62.141.20:443

104.168.140.145:443

51.68.145.171:443

108.62.118.170:443

192.119.72.133:443

23.108.57.201:443
rc4.plain

Targets

    • Target

      Contract_02_21_Copy#29.exe

    • Size

      1.4MB

    • MD5

      599378917c2d2a802c8c2063fac651c3

    • SHA1

      022c49842268d62e1956fc3dd67d6bbfb878844c

    • SHA256

      1c17ffd1b75481630244bb1f0f78b819798f900966210b0e3ca06276b38558f2

    • SHA512

      ba1eddcd059d9f322fa312365e28da0c56496033423c39736b71fd58623cd685253dc071de2c91a7f89094fa4196e4df91ef197664672903d835f579e034c8fb

    • SSDEEP

      24576:AArPuHyMNjmtUwvd1HFG74s54663DxFxxqQQGAj/uuf9:ARHyqjGUydzC4cFItwkW

    Score
    10/10
    bumblebee21macatrojan

    • BumbleBee

      BumbleBee is a webshell malware written in C++.

      trojanbumblebee

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks