bumblebee | 4063fab9176db3960fa6014173b6c7ba52f19424887f5a6205ff73aa447ada61

Sharing

Copy URL Twitter E-mail

General

Target
4063fab9176db3960fa6014173b6c7ba52f19424887f5a6205ff73aa447ada61
Size 2.2MB
Sample240410-mlny2afe8z
SHA256 4063fab9176db3960fa6014173b6c7ba52f19424887f5a6205ff73aa447ada61
MD5 3f34d94803e9c8bc0a9cd09f507bc515
SHA1 be9e16933821f27477f3616b5fc7dc21cf136ad9
SHA512 11067c9cfa3eddd399cc38bb039c597534f0191804aae013265a5c438217571d736ef8c38a53853a9be5b5560a5ecc98bd4e5b51a33eca1179e66902bd01608a
SSDEEP 49152:dmxV8r49vGU/vrw/duhM6DRCQstcYIMkqPGyoWY:6zM6EQsGLMk1y1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vps1group bumblebee

Malware Config

Extracted

Family

bumblebee

Botnet

VPS1GROUP

23.82.19.208:443

Signatures

Bumblebee family
bumblebee

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4063fab9176db3960fa6014173b6c7ba52f19424887f5a6205ff73aa447ada61

File Explorer

4063fab9176db3960fa6014173b6c7ba52f19424887f5a6205ff73aa447ada61

.dll 2.2MB

4063fab9176db3960fa6014173b6c7ba52f19424887f5a6205ff73aa447ada61

IMPHASH bc1fc12dfcfbfb96d61fc1ad211049f7
SHA256 4063fab9176db3960fa6014173b6c7ba52f19424887f5a6205ff73aa447ada61
MD5 3f34d94803e9c8bc0a9cd09f507bc515
SHA1 be9e16933821f27477f3616b5fc7dc21cf136ad9
SHA512 11067c9cfa3eddd399cc38bb039c597534f0191804aae013265a5c438217571d736ef8c38a53853a9be5b5560a5ecc98bd4e5b51a33eca1179e66902bd01608a
SSDEEP 49152:dmxV8r49vGU/vrw/duhM6DRCQstcYIMkqPGyoWY:6zM6EQsGLMk1y1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1213448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

TlsAlloc QueueUserAPC CreateWaitableTimerA DeleteCriticalSection VerSetConditionMask SleepEx TlsGetValue GetSystemTimeAsFileTime TlsFree CreateIoCompletionPort FileTimeToSystemTime LoadLibraryW GetLocalTime GetProcAddress SystemTimeToFileTime GetModuleHandleW GetCurrentProcess Thread32Next Thread32First GetModuleHandleA OpenProcess LoadLibraryA VirtualProtectEx OpenThread GetStdHandle GetFileType WriteFile MultiByteToWideChar SwitchToFiber DeleteFiber CreateFiber WideCharToMultiByte ConvertFiberToThread ConvertThreadToFiber QueryPerformanceCounter GetTickCount GlobalMemoryStatus GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetSystemTime ReadFile GetModuleFileNameW SetFilePointer lstrlenA CreateFileW lstrcmpA TerminateThread VirtualAlloc HeapFree CreateFileA HeapReAlloc HeapAlloc GetFileSize GetProcessHeap VirtualQuery lstrcpyA GetFullPathNameW GetCurrentDirectoryW SystemTimeToTzSpecificLocalTime PeekNamedPipe SetEvent CreateEventW PostQueuedCompletionStatus GetQueuedCompletionStatus LeaveCriticalSection InitializeCriticalSectionAndSpinCount WaitForMultipleObjects EnterCriticalSection SetLastError VerifyVersionInfoA TlsSetValue SetWaitableTimer GetCurrentProcessId ExitProcess GetLastError GetModuleHandleExA Sleep lstrcatA GetModuleFileNameA GetDriveTypeW FindFirstFileW SetEndOfFile HeapSize SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindNextFileA FindFirstFileExA FindClose GetTimeZoneInformation OutputDebugStringW SetStdHandle SetFilePointerEx GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP WriteConsoleW SetConsoleCtrlHandler GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary CreateDirectoryA GetFileAttributesA CloseHandle CreateToolhelp32Snapshot WaitForSingleObject RtlUnwindEx RaiseException RtlPcToFileHeader InterlockedFlushSList EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId InitializeSListHead FormatMessageA LocalFree

user32

GetUserObjectInformationW GetProcessWindowStation wsprintfW MessageBoxW

advapi32

CryptDecrypt LookupPrivilegeValueA DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash GetUserNameW CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey

shell32

SHGetSpecialFolderPathA

ole32

CoUninitialize CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoCreateInstance

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

ws2_32

WSASocketW getaddrinfo connect WSARecv getsockopt freeaddrinfo WSASetLastError setsockopt WSAGetLastError recv send select WSASend closesocket ioctlsocket WSACleanup WSAStartup

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertOpenStore CertGetCertificateContextProperty

shlwapi

StrChrA StrToIntA

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

640KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

124KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

4063fab9176db3960fa6014173b6c7ba52f19424887f5a6205ff73aa447ada61

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

crypt32

shlwapi

generic