bumblebee | 1fd5326034792c0f0fb00be77629a10ac9162b2f473f96072397a5d639da45dd

Sharing

Copy URL

Twitter E-mail

General

Target

1fd5326034792c0f0fb00be77629a10ac9162b2f473f96072397a5d639da45dd
Size

1009KB
MD5

ed902c1796eec0c511682075b8fe63c5
SHA1

e9f1aa4fdd749854aead68a9566d1b960f4efc90
SHA256

1fd5326034792c0f0fb00be77629a10ac9162b2f473f96072397a5d639da45dd
SHA512

fa48f27f5c80eac75b29b71b94f1b1767186910239c6afb868bc82de5e8f032e552d5eed251b04a0d4512a3234feda810a1060d7d61972350fd0bbdab8bbd7f4
SSDEEP

24576:DEGtDN22ifihJad2/hqk0RsUCbBYTIuw5P4:DE4D429hJe28kJUCzA

Score

10^/10

vps2g bumblebee

Malware Config

Extracted

Family

bumblebee

Botnet

VPS2G

23.81.246.187:443

Signatures

Bumblebee family
bumblebee
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack002/sysmon64.exe

resource
unpack002/sysmon64.exe

Files

1fd5326034792c0f0fb00be77629a10ac9162b2f473f96072397a5d639da45dd
.zip
folder-223205.iso
.iso
documents.lnk
.lnk
sysmon64.exe
.exe windows:6 windows x64 arch:x64

e540de65c610ff7d74677289a61a259e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

TlsAlloc
QueueUserAPC
CreateWaitableTimerA
DeleteCriticalSection
VerSetConditionMask
SleepEx
TlsGetValue
GetSystemTimeAsFileTime
TlsFree
CreateIoCompletionPort
FileTimeToSystemTime
LoadLibraryW
GetLocalTime
GetProcAddress
SystemTimeToFileTime
GetModuleHandleW
GetCurrentProcess
Thread32Next
Thread32First
GetModuleHandleA
OpenProcess
LoadLibraryA
VirtualProtectEx
OpenThread
GetStdHandle
GetFileType
WriteFile
MultiByteToWideChar
SwitchToFiber
DeleteFiber
CreateFiber
WideCharToMultiByte
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GetTickCount
GlobalMemoryStatus
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetSystemTime
ReadFile
GetModuleFileNameW
SetFilePointer
lstrlenA
CreateFileW
lstrcmpA
TerminateThread
HeapFree
CreateFileA
HeapReAlloc
HeapAlloc
GetFileSize
GetProcessHeap
GetFullPathNameW
GetCurrentDirectoryW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetEvent
CreateEventW
PostQueuedCompletionStatus
WaitForSingleObject
GetQueuedCompletionStatus
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
EnterCriticalSection
SetLastError
VerifyVersionInfoA
TlsSetValue
SetWaitableTimer
GetCurrentProcessId
ExitProcess
GetLastError
GetModuleHandleExA
Sleep
lstrcatA
GetDriveTypeW
FindFirstFileW
SetEndOfFile
HeapSize
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
OutputDebugStringW
SetStdHandle
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
WriteConsoleW
SetConsoleCtrlHandler
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
CreateDirectoryA
GetFileAttributesA
GetModuleFileNameA
CloseHandle
CreateToolhelp32Snapshot
RtlUnwindEx
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
InitializeSListHead
FormatMessageA
LocalFree
RtlPcToFileHeader
RaiseException

user32

GetUserObjectInformationW
GetProcessWindowStation
wsprintfW
MessageBoxW

advapi32

CryptDecrypt
LookupPrivilegeValueA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
GetUserNameW
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey

shell32

SHGetSpecialFolderPathA

ole32

CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

ws2_32

WSASocketW
getaddrinfo
WSAStartup
WSARecv
getsockopt
freeaddrinfo
WSASetLastError
setsockopt
WSAGetLastError
recv
send
select
WSASend
closesocket
ioctlsocket
WSACleanup
connect

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty

Exports

Exports

ProcessLoad

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 602KB - Virtual size: 602KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 125KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

e540de65c610ff7d74677289a61a259e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

crypt32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 602KB - Virtual size: 602KB

.data Size: 125KB - Virtual size: 149KB

.pdata Size: 79KB - Virtual size: 79KB

.gfids Size: 512B - Virtual size: 480B

.tls Size: 5KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 23KB - Virtual size: 23KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 602KB - Virtual size: 602KB

.data
Size: 125KB - Virtual size: 149KB

.pdata
Size: 79KB - Virtual size: 79KB

.gfids
Size: 512B - Virtual size: 480B

.tls
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 23KB - Virtual size: 23KB