bumblebee | 0b7b1d42e60ceeff49ef796d4d4f5b14[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

0b7b1d42e60ceeff49ef796d4d4f5b14.bin
Size

465KB
MD5

1b55253cdb7905c7e998012a8a07bfa6
SHA1

989ddf7bd2f35f222f96cd66a65a1c3d11c2abad
SHA256

c85af8e6e72472a8567e651f81259e94b4637e031516e224f83322fb917efd23
SHA512

35cebe668ff285816db7b77a92dce3c60771bd3da31df3933dcfb231d3efdceb86cfde9992449b204937bb9a64a11ebfac63c405e168661e5e7694729f583fae
SSDEEP

12288:sz4GZHepg4rIDRQXWfMqebkLNd9ZbuKenvNCtrO/0:s8I+i8XaYmdrbu7vMe0

Score

10^/10

lnk1 bumblebee

Malware Config

Extracted

Family

bumblebee

Botnet

lnk1

rc4.plain

Signatures

Bumblebee family
bumblebee

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/af59ce785e062bf0d198eb4e3bdbc1ee57d58164de6dc1faf38836c670ef6f7d.exe

Files

0b7b1d42e60ceeff49ef796d4d4f5b14.bin
.zip

Password: infected
af59ce785e062bf0d198eb4e3bdbc1ee57d58164de6dc1faf38836c670ef6f7d.exe
.exe windows:6 windows x64

0e7d77b31705b90280a066941e785013

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

PathCombineW
StrCmpIW
PathFindFileNameW
PathRemoveExtensionW
StrStrIW

kernel32

GetModuleFileNameA
CreateEventW
AreFileApisANSI
ReadFile
SetHandleInformation
SetWaitableTimer
TlsSetValue
CreateNamedPipeA
SetLastError
EnterCriticalSection
WriteFile
TerminateProcess
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
GetCurrentThreadId
GetSystemDirectoryW
PostQueuedCompletionStatus
MultiByteToWideChar
FormatMessageW
GetLastError
CreateFileA
SetEvent
TerminateThread
TlsAlloc
QueueUserAPC
LocalFree
DeleteCriticalSection
VerSetConditionMask
WideCharToMultiByte
GetEnvironmentStrings
SleepEx
VerifyVersionInfoW
TlsGetValue
CreateProcessA
TlsFree
FormatMessageA
CreateIoCompletionPort
FreeEnvironmentStringsA
GetExitCodeProcess
GetProcAddress
GetModuleHandleW
Sleep
GetCurrentProcess
Thread32Next
Thread32First
GetModuleHandleA
LoadLibraryA
VirtualProtectEx
OpenThread
HeapFree
lstrlenA
CreateFileW
HeapReAlloc
HeapAlloc
GetProcessHeap
GetModuleFileNameW
SetFilePointer
lstrcmpA
GetFileAttributesA
Wow64DisableWow64FsRedirection
ExpandEnvironmentStringsW
Wow64RevertWow64FsRedirection
GetWindowsDirectoryW
GetCurrentDirectoryW
GlobalMemoryStatusEx
GetFileAttributesW
GetStdHandle
QueryPerformanceFrequency
QueryPerformanceCounter
RaiseException
HeapSize
WriteConsoleW
WaitForSingleObject
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetCurrentProcessId
CopyFileA
lstrcatA
FindClose
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
DecodePointer
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileA
EncodePointer
RtlPcToFileHeader
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OpenProcess
FindFirstFileExA
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
ExitProcess
GetACP
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
RtlUnwindEx
InitializeSListHead
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime

user32

GetCursorPos
FindWindowW

advapi32

RegQueryValueExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
GetUserNameW
CloseServiceHandle
OpenSCManagerW
EnumServicesStatusExW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
LookupPrivilegeValueW

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoUninitialize

oleaut32

SafeArrayGetUBound
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
SysAllocString
VariantClear
VariantInit

mpr

WNetGetProviderNameW

iphlpapi

GetAdaptersInfo

wtsapi32

WTSEnumerateProcessesA
WTSFreeMemory

ws2_32

htons
inet_addr
inet_ntop
closesocket
recv
send
setsockopt
WSAGetLastError
connect
socket
WSAStartup
getsockname
getaddrinfo
freeaddrinfo
WSACleanup

rpcrt4

RpcServerRegisterIfEx
RpcMgmtStopServerListening
RpcServerListen
NdrServerCall2
RpcBindingFree
RpcServerUnregisterIf
RpcServerUseProtseqEpA

Exports

Exports

dataCheck

Sections

.text
Size: 632KB - Virtual size: 631KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Password: infected

0e7d77b31705b90280a066941e785013

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

mpr

iphlpapi

wtsapi32

ws2_32

rpcrt4

Exports

Exports

Sections

.text Size: 632KB - Virtual size: 631KB

.rdata Size: 275KB - Virtual size: 274KB

.data Size: 74KB - Virtual size: 81KB

.pdata Size: 29KB - Virtual size: 28KB

.gfids Size: 2KB - Virtual size: 1KB

.tls Size: 5KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 632KB - Virtual size: 631KB

.rdata
Size: 275KB - Virtual size: 274KB

.data
Size: 74KB - Virtual size: 81KB

.pdata
Size: 29KB - Virtual size: 28KB

.gfids
Size: 2KB - Virtual size: 1KB

.tls
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 5KB - Virtual size: 5KB