General

  • Target

    fd426609da2774cf55923cb4d2320feef0f2bce24ae7abff0a015c7d7b0042e6

  • Size

    1.1MB

  • Sample

    240314-ba5xmagh96

  • MD5

    0448b3e869ee9c95befe7b0c69f79401

  • SHA1

    0a546f7c1c2328e82e2f77b0fdb076ef43ba0bbe

  • SHA256

    fd426609da2774cf55923cb4d2320feef0f2bce24ae7abff0a015c7d7b0042e6

  • SHA512

    1e045ea70e278505188c81a8e6d82a94b640687cc8dd8c461d8136386ad0f943bbc1fb9a8c07e5fb1c822d33893fdd131501a60d566f0a6e428bf0cccdfaec2f

  • SSDEEP

    12288:yh/mUxV9yUJLB9hbJGk01nVJT24GUhKnsHwuDVPVIzI2mxFfokvqRLKAV55PH:yh/nBB9hSZGAwysoxFfooqRLb55P

Score
10/10

Malware Config

Extracted

Family

bumblebee

Botnet

js1

Attributes
  • dga

    v5b6ml4o0nq.life

    d4mdwvwm8c8.life

    6uwsby1vmyj.life

    mp0zt8ctj70.life

    tkqeai6tead.life

    2xek4jch3xf.life

    ugwfyzhao98.life

    auq2lckl2e0.life

    1odrw6y2sad.life

    hk5ekbl02o8.life

    knqbckw92x9.life

    nnjg4uf5vij.life

    nk4xgtjnvs9.life

    7xbapl162fg.life

    8djp3zmzbif.life

    nojzch0pgfo.life

    b9dsvlk8f23.life

    v3jmvczsden.life

    8vpndr56eb1.life

    5gbcnik1ba0.life

    k6r11hdxxm2.life

    wc87pfwqvbx.life

    3b73akpd5ip.life

    5o5f0or1704.life

    ve0tcgv0oks.life

    tsd7d3pynml.life

    kfjgd8tquo8.life

    ff7xb5l0zl5.life

    27qrg2npbhu.life

    fvawc0jtdkp.life

  • dga_seed

    OKFsgukk

  • domain_length

    11

  • num_dga_domains

    100

  • port

    443

rc4.plain

Targets

    • Target

      fd426609da2774cf55923cb4d2320feef0f2bce24ae7abff0a015c7d7b0042e6

    • Size

      1.1MB

    • MD5

      0448b3e869ee9c95befe7b0c69f79401

    • SHA1

      0a546f7c1c2328e82e2f77b0fdb076ef43ba0bbe

    • SHA256

      fd426609da2774cf55923cb4d2320feef0f2bce24ae7abff0a015c7d7b0042e6

    • SHA512

      1e045ea70e278505188c81a8e6d82a94b640687cc8dd8c461d8136386ad0f943bbc1fb9a8c07e5fb1c822d33893fdd131501a60d566f0a6e428bf0cccdfaec2f

    • SSDEEP

      12288:yh/mUxV9yUJLB9hbJGk01nVJT24GUhKnsHwuDVPVIzI2mxFfokvqRLKAV55PH:yh/nBB9hSZGAwysoxFfooqRLb55P

    Score
    10/10
    • BumbleBee

      BumbleBee is a loader malware written in C++.

    • Detects executables referencing combination of virtualization drivers

    • Detects executables referencing virtualization MAC addresses

    • Suspicious use of NtCreateThreadExHideFromDebugger

MITRE ATT&CK Matrix

Tasks