General

  • Target

    LdrAddx64.dll

  • Size

    2.1MB

  • Sample

    241004-yd535axbng

  • MD5

    90010f98335ee9e5a46dd1f2f54ab6ef

  • SHA1

    5886146225bef728847566c3af5b169a277b4338

  • SHA256

    4c2af6abed05ca2b5164ee2c3a999da829b65701fd879dffbc6b73f09209f187

  • SHA512

    3da2fad887882e6a6c0a12e79f42b59b3a580412fb9a6dc4c38819e89c5873caef136bb44593ab4b2ceb7e2653d96dbc70a16df965389d41feed79fde76a7852

  • SSDEEP

    49152:gGgJ3vE7rwsY5+a+h1cHkUnl/u9Zx/PgxeAaEAbK2V0rG:mavI5+qHxsgxeAgsrG

Score
10/10

Malware Config

Extracted

Family

bumblebee

Botnet

msi

Attributes
  • dga

    tvx1ovdepj8.life

    acgr6r8zdot.life

    ilofx941igp.life

    8x2apo5m7ri.life

    x9yrzer0ndt.life

    93j4v4jopzd.life

    ameagxzo2f7.life

    nyy41uibsv5.life

    ru4jvijdytq.life

    l9t6r0y6cvi.life

    f4vb9n3tdvh.life

    9do3mcejztt.life

    pxu1ajsdhqr.life

    7exy2b231n2.life

    vu5b47m18jn.life

    6mnudp7zj73.life

    p5047yjrb8q.life

    d0xtxp89bb9.life

    ygo9u1fkwux.life

    fig3gj0v6qe.life

    38f5wvwwn7o.life

    txgogs9p8a1.life

    uyn0icgx1kv.life

    2z1ls31az7s.life

    0cc2z8zrnhf.life

    fsr2hskx44p.life

    du19ek78tjw.life

    234ct3lkozp.life

    he8fq4k8d3w.life

    7ewh8ltr7il.life

  • dga_seed

    1.0163655285949564e+18

  • domain_length

    11

  • num_dga_domains

    100

  • port

    443

rc4.plain

Targets

    • Target

      LdrAddx64.dll

    • Size

      2.1MB

    • MD5

      90010f98335ee9e5a46dd1f2f54ab6ef

    • SHA1

      5886146225bef728847566c3af5b169a277b4338

    • SHA256

      4c2af6abed05ca2b5164ee2c3a999da829b65701fd879dffbc6b73f09209f187

    • SHA512

      3da2fad887882e6a6c0a12e79f42b59b3a580412fb9a6dc4c38819e89c5873caef136bb44593ab4b2ceb7e2653d96dbc70a16df965389d41feed79fde76a7852

    • SSDEEP

      49152:gGgJ3vE7rwsY5+a+h1cHkUnl/u9Zx/PgxeAaEAbK2V0rG:mavI5+qHxsgxeAgsrG

    Score
    8/10
    • Blocklisted process makes network request

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks