Extracted

Extracted

Extracted

• • Target

    cfgtbvh.exe

  • Size

    237KB

  • MD5

    51b3cddd75069bda9deb36fd539442e2

  • SHA1

    a5183c20f329a3ea3726ce2c8300b0f2654ab531

  • SHA256

    f0098ef0f31aa50b097bfb3ac7e420c518a697394a0ffed54640a55045263fa9

  • SHA512

    50e78682a53f0ef631e7faaf2892057b35e5895afee8d8520f2a3a49f99e239912bef67e8ebe70b099528b5a1753a06aad0675bc3dec64b9a2e7b605ced2d06c

  • SSDEEP

    6144:DL3v+mWnRzxvqRYwqgft1rSVsMAdaV/BaW:D7v+myRtqRYRgX20di/F

  Score

  10^/10

  bumblebeerhadamanthyssmokeloaderinstpub4BumbleBeebackdoorcollectionstealertrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Detect rhadamanthys stealer shellcode

  • Detects win.bumblebee.

    Detects BumbleBee Payload.

    BumbleBee

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1