bumblebee | 08cd6983f183ef65eabd073c01f137a913282504e2502ac34a1be3e599ac386b

Sharing

Copy URL Twitter E-mail

General

Target
08cd6983f183ef65eabd073c01f137a913282504e2502ac34a1be3e599ac386b
Size 2.2MB
Sample240410-le6ptsae87
SHA256 08cd6983f183ef65eabd073c01f137a913282504e2502ac34a1be3e599ac386b
MD5 e6a046d1baa7cd2100bdf48102b8a144
SHA1 a7838aa4f42c95ee245f9b62d2c894a4c2067894
SHA512 3d7cad15f9577926af9ee100d71fbf50a9f70c681d4735836a668b83828c97e63e514e78c9b64b2f328ae352a852d6e4053413888342d16196652c7d6283d242
SSDEEP 49152:KR7M9r/8AmAJXPasx29pSvKtxqJ7w+dIM9qPGrfepLX:VqSv/J7H+M91rmpz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vps1group bumblebee

Malware Config

Extracted

Family

bumblebee

Botnet

VPS1GROUP

23.82.19.208:443

Signatures

Bumblebee family
bumblebee

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08cd6983f183ef65eabd073c01f137a913282504e2502ac34a1be3e599ac386b

File Explorer

08cd6983f183ef65eabd073c01f137a913282504e2502ac34a1be3e599ac386b

.dll 2.2MB

08cd6983f183ef65eabd073c01f137a913282504e2502ac34a1be3e599ac386b

IMPHASH bc1fc12dfcfbfb96d61fc1ad211049f7
SHA256 08cd6983f183ef65eabd073c01f137a913282504e2502ac34a1be3e599ac386b
MD5 e6a046d1baa7cd2100bdf48102b8a144
SHA1 a7838aa4f42c95ee245f9b62d2c894a4c2067894
SHA512 3d7cad15f9577926af9ee100d71fbf50a9f70c681d4735836a668b83828c97e63e514e78c9b64b2f328ae352a852d6e4053413888342d16196652c7d6283d242
SSDEEP 49152:KR7M9r/8AmAJXPasx29pSvKtxqJ7w+dIM9qPGrfepLX:VqSv/J7H+M91rmpz
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1213320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

TlsAlloc QueueUserAPC CreateWaitableTimerA DeleteCriticalSection VerSetConditionMask SleepEx TlsGetValue GetSystemTimeAsFileTime TlsFree CreateIoCompletionPort FileTimeToSystemTime LoadLibraryW GetLocalTime GetProcAddress SystemTimeToFileTime GetModuleHandleW GetCurrentProcess Thread32Next Thread32First GetModuleHandleA OpenProcess LoadLibraryA VirtualProtectEx OpenThread GetStdHandle GetFileType WriteFile MultiByteToWideChar SwitchToFiber DeleteFiber CreateFiber WideCharToMultiByte ConvertFiberToThread ConvertThreadToFiber QueryPerformanceCounter GetTickCount GlobalMemoryStatus GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetSystemTime ReadFile GetModuleFileNameW SetFilePointer lstrlenA CreateFileW lstrcmpA TerminateThread VirtualAlloc HeapFree CreateFileA HeapReAlloc HeapAlloc GetFileSize GetProcessHeap VirtualQuery lstrcpyA GetFullPathNameW GetCurrentDirectoryW SystemTimeToTzSpecificLocalTime PeekNamedPipe SetEvent CreateEventW PostQueuedCompletionStatus GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects EnterCriticalSection SetLastError VerifyVersionInfoA TlsSetValue SetWaitableTimer GetCurrentProcessId ExitProcess GetLastError GetModuleHandleExA Sleep lstrcatA GetModuleFileNameA GetDriveTypeW FindFirstFileW SetEndOfFile HeapSize SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindNextFileA FindFirstFileExA FindClose GetTimeZoneInformation OutputDebugStringW SetStdHandle SetFilePointerEx GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP WriteConsoleW SetConsoleCtrlHandler GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary CreateDirectoryA GetFileAttributesA CloseHandle CreateToolhelp32Snapshot WaitForSingleObject RtlUnwindEx RaiseException RtlPcToFileHeader InterlockedFlushSList EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId InitializeSListHead FormatMessageA LocalFree

user32

GetUserObjectInformationW GetProcessWindowStation wsprintfW MessageBoxW

advapi32

CryptDecrypt LookupPrivilegeValueA DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash GetUserNameW CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey

shell32

SHGetSpecialFolderPathA

ole32

CoUninitialize CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoCreateInstance

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

ws2_32

WSASocketW getaddrinfo connect WSARecv getsockopt freeaddrinfo WSASetLastError setsockopt WSAGetLastError recv send select WSASend closesocket ioctlsocket WSACleanup WSAStartup

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertOpenStore CertGetCertificateContextProperty

shlwapi

StrChrA StrToIntA

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

640KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

124KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

08cd6983f183ef65eabd073c01f137a913282504e2502ac34a1be3e599ac386b

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

crypt32

shlwapi

generic