Overview

overview

10

Static

static

1

Contract_0...55.zip

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Contract_02_21_Copy#55.zip

  • Size

    909KB

  • Sample

    230222-n1ketsda3t

  • MD5

    902e24b235fe7408391f5a55565e30be

  • SHA1

    49d79a3511857654dbc24a498404505d445e447e

  • SHA256

    8a345b6f2e1e723587b6156ad998dc7eafcaafc9c7380fcbc52c626f8388f328

  • SHA512

    a7504040e0898d29bef33f31172aa08c9f8069c927e50cc6a90d92876266e80b62bdb7b615905f658e9f297caf2b58b1fe0e50d63dbaf50a3ac900e1b76d75d9

  • SSDEEP

    24576:OgmrD9eOq9Q0BPVabisQFOrpz2gz1vnBTlP27g:OLr5eOcxPmisQFOXRJ5Pgg

Score
10/10
bumblebee21macapersistencetrojan

Malware Config

Extracted

Family

bumblebee

Botnet

21maca

C2

108.62.141.20:443

104.168.140.145:443

51.68.145.171:443

108.62.118.170:443

192.119.72.133:443

23.108.57.201:443
rc4.plain

Targets

    • Target

      Contract_02_21_Copy#55.zip

    • Size

      909KB

    • MD5

      902e24b235fe7408391f5a55565e30be

    • SHA1

      49d79a3511857654dbc24a498404505d445e447e

    • SHA256

      8a345b6f2e1e723587b6156ad998dc7eafcaafc9c7380fcbc52c626f8388f328

    • SHA512

      a7504040e0898d29bef33f31172aa08c9f8069c927e50cc6a90d92876266e80b62bdb7b615905f658e9f297caf2b58b1fe0e50d63dbaf50a3ac900e1b76d75d9

    • SSDEEP

      24576:OgmrD9eOq9Q0BPVabisQFOrpz2gz1vnBTlP27g:OLr5eOcxPmisQFOXRJ5Pgg

    Score
    10/10
    bumblebee21macapersistencetrojan

    • BumbleBee

      BumbleBee is a webshell malware written in C++.

      trojanbumblebee

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks