bumblebee | 17E93000000[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

17E93000000.bin
Size

1024KB
MD5

0b7b1d42e60ceeff49ef796d4d4f5b14
SHA1

54a528d2f62b1af4c331f2c5ae03efdabc793833
SHA256

af59ce785e062bf0d198eb4e3bdbc1ee57d58164de6dc1faf38836c670ef6f7d
SHA512

1c54198465f6b06934c269fbc51980837786eb0da7cafe2cb0ec676d2e5c24dade5370e4234c8b3790c42dc0f2fee27fc6588c1b7ec078ea72a22d1a05d40163
SSDEEP

24576:tAZBB0pE2CwPwsqqSUZ57pBloBph3xbjrYWw:pecDqqSOvloBPZj03

Score

10^/10

lnk1 bumblebee

Malware Config

Extracted

Family

bumblebee

Botnet

lnk1

rc4.plain

Signatures

Bumblebee family
bumblebee

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17E93000000.bin

Files

17E93000000.bin
.exe windows:6 windows x64

0e7d77b31705b90280a066941e785013

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

PathCombineW
StrCmpIW
PathFindFileNameW
PathRemoveExtensionW
StrStrIW

kernel32

GetModuleFileNameA
CreateEventW
AreFileApisANSI
ReadFile
SetHandleInformation
SetWaitableTimer
TlsSetValue
CreateNamedPipeA
SetLastError
EnterCriticalSection
WriteFile
TerminateProcess
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
GetCurrentThreadId
GetSystemDirectoryW
PostQueuedCompletionStatus
MultiByteToWideChar
FormatMessageW
GetLastError
CreateFileA
SetEvent
TerminateThread
TlsAlloc
QueueUserAPC
LocalFree
DeleteCriticalSection
VerSetConditionMask
WideCharToMultiByte
GetEnvironmentStrings
SleepEx
VerifyVersionInfoW
TlsGetValue
CreateProcessA
TlsFree
FormatMessageA
CreateIoCompletionPort
FreeEnvironmentStringsA
GetExitCodeProcess
GetProcAddress
GetModuleHandleW
Sleep
GetCurrentProcess
Thread32Next
Thread32First
GetModuleHandleA
LoadLibraryA
VirtualProtectEx
OpenThread
HeapFree
lstrlenA
CreateFileW
HeapReAlloc
HeapAlloc
GetProcessHeap
GetModuleFileNameW
SetFilePointer
lstrcmpA
GetFileAttributesA
Wow64DisableWow64FsRedirection
ExpandEnvironmentStringsW
Wow64RevertWow64FsRedirection
GetWindowsDirectoryW
GetCurrentDirectoryW
GlobalMemoryStatusEx
GetFileAttributesW
GetStdHandle
QueryPerformanceFrequency
QueryPerformanceCounter
RaiseException
HeapSize
WriteConsoleW
WaitForSingleObject
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetCurrentProcessId
CopyFileA
lstrcatA
FindClose
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
DecodePointer
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileA
EncodePointer
RtlPcToFileHeader
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
OpenProcess
FindFirstFileExA
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
ExitProcess
GetACP
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
RtlUnwindEx
InitializeSListHead
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime

user32

GetCursorPos
FindWindowW

advapi32

RegQueryValueExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
GetUserNameW
CloseServiceHandle
OpenSCManagerW
EnumServicesStatusExW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
LookupPrivilegeValueW

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoUninitialize

oleaut32

SafeArrayGetUBound
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
SysAllocString
VariantClear
VariantInit

mpr

WNetGetProviderNameW

iphlpapi

GetAdaptersInfo

wtsapi32

WTSEnumerateProcessesA
WTSFreeMemory

ws2_32

htons
inet_addr
inet_ntop
closesocket
recv
send
setsockopt
WSAGetLastError
connect
socket
WSAStartup
getsockname
getaddrinfo
freeaddrinfo
WSACleanup

rpcrt4

RpcServerRegisterIfEx
RpcMgmtStopServerListening
RpcServerListen
NdrServerCall2
RpcBindingFree
RpcServerUnregisterIf
RpcServerUseProtseqEpA

Exports

Exports

dataCheck

Sections

.text
Size: 632KB - Virtual size: 631KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

0e7d77b31705b90280a066941e785013

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

mpr

iphlpapi

wtsapi32

ws2_32

rpcrt4

Exports

Exports

Sections

.text Size: 632KB - Virtual size: 631KB

.rdata Size: 275KB - Virtual size: 274KB

.data Size: 74KB - Virtual size: 81KB

.pdata Size: 29KB - Virtual size: 28KB

.gfids Size: 2KB - Virtual size: 1KB

.tls Size: 5KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 632KB - Virtual size: 631KB

.rdata
Size: 275KB - Virtual size: 274KB

.data
Size: 74KB - Virtual size: 81KB

.pdata
Size: 29KB - Virtual size: 28KB

.gfids
Size: 2KB - Virtual size: 1KB

.tls
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 5KB - Virtual size: 5KB