bumblebee | LdrAddx64[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

LdrAddx64.dll
Size

2.1MB
MD5

637e0ef5d12fd38122ea517dc57854f3
SHA1

169c40bbfa251680af68dbac9dbbca5bfdd60d61
SHA256

a20d56ab2e53b3a599af9904f163bb2e1b2bb7f2c98432519e1fbe87c3867e66
SHA512

c82f9087dae66a87adf0dbca6834854bb21f15252cc6f571b595895d07f8ce368832bfd380df51c2f4fd07287a7ade0a81b5636a1e72e2ac18ed2dc66f51262d
SSDEEP

49152:bGgJ3vE7rwsY5+a+h1cHkUnl/u9Zx/PgxeAaE+bK2i4rG:NavI5+qHxsgxeAenrG

Score

10^/10

msi bumblebee

Malware Config

Extracted

Family

bumblebee

Botnet

msi

Attributes

dga
tvx1ovdepj8.life

acgr6r8zdot.life

ilofx941igp.life

8x2apo5m7ri.life

x9yrzer0ndt.life

93j4v4jopzd.life

ameagxzo2f7.life

nyy41uibsv5.life

ru4jvijdytq.life

l9t6r0y6cvi.life

f4vb9n3tdvh.life

9do3mcejztt.life

pxu1ajsdhqr.life

7exy2b231n2.life

vu5b47m18jn.life

6mnudp7zj73.life

p5047yjrb8q.life

d0xtxp89bb9.life

ygo9u1fkwux.life

fig3gj0v6qe.life

38f5wvwwn7o.life

txgogs9p8a1.life

uyn0icgx1kv.life

2z1ls31az7s.life

0cc2z8zrnhf.life

fsr2hskx44p.life

du19ek78tjw.life

234ct3lkozp.life

he8fq4k8d3w.life

7ewh8ltr7il.life

dw34kmgfl7t.life

f2j20ayqh8y.life

331k2rdkmmb.life

37z6li6l9y2.life

dpgs2lt1sbz.life

plll0xq4y82.life

bzc9sq2pz53.life

7r8ln1wswth.life

y9neib92f2m.life

m5iukps17y7.life

xo8be64ejh2.life

widn8soih8u.life

08mkuqnx6gv.life

lzeqr3apopn.life

o4m5a5no7e8.life

2u8znzsbrto.life

dxyob8x456a.life

lrugnff8fkc.life

38i6lh0rpze.life

mjb3r6mcs1f.life

vl41cymzzfq.life

qc4mwjiop45.life

z3z4fq0420z.life

0tab35o0swu.life

4izk0gc9is6.life

6brdh3p893b.life

736d0mvetjw.life

drmk5rdefb5.life

1v0xhie4os8.life

khxcp22s3dz.life

8z9m8hndrhp.life

xeoz1f1vjs0.life

lobavyclh8e.life

in4pzu7t2pv.life

j280b59doxz.life

6q894zusd4k.life

y7pzxau0717.life

bev8ymaajb7.life

glux8x5b8d6.life

yan95akxgqt.life

9qiliikd3sp.life

ge0lpqif3ar.life

ar7xakeve0o.life

eb4l6wisq9z.life

1grovn87c8s.life

wdga570b8pz.life

nzs8vi9w5o8.life

q7dfpyyhe08.life

exueqqmz3ia.life

65r8nx12fqr.life

vauy5ah65sx.life

8hjv8mbhrlj.life

eeqwg3mzq07.life

b1h0uaabzyz.life

8qvt5iabz5n.life

8ru044xed25.life

w8ligr695sd.life

3e6rrifr5fn.life

9f6p9g7x13s.life

ibcm5at6qrz.life

spd22scperm.life

4k59ij2ujeu.life

07zxfo0kere.life

nhdeapyfg7e.life

y0zvqpi42no.life

zdf5ki8x9r0.life

8mgj12azbyd.life

l6syolvczan.life

mk7plk9c6i2.life

hudrx8fn980.life
dga_seed
1.0163655285949564e+18
domain_length
11
num_dga_domains
100
port
443

rc4.plain

Signatures

Bumblebee family
bumblebee

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LdrAddx64.dll

Files

LdrAddx64.dll
.dll windows:6 windows x64 arch:x64

68a7a86448a19e2cda38fa737fa6ad40

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shlwapi

StrStrIW
PathRemoveExtensionW
PathFindFileNameW
PathCombineW
StrCmpIW

kernel32

ReadFile
SetHandleInformation
SetWaitableTimer
TlsSetValue
CreateNamedPipeA
SetLastError
EnterCriticalSection
WriteFile
TerminateProcess
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
GetCurrentThreadId
GetSystemDirectoryW
PostQueuedCompletionStatus
MultiByteToWideChar
FormatMessageW
GetLastError
CreateFileA
TerminateThread
TlsAlloc
QueueUserAPC
LocalFree
DeleteCriticalSection
VerSetConditionMask
WideCharToMultiByte
GetEnvironmentStrings
SleepEx
VerifyVersionInfoW
TlsGetValue
CreateProcessA
TlsFree
FormatMessageA
CreateIoCompletionPort
FreeEnvironmentStringsA
GetExitCodeProcess
LoadLibraryW
GetProcAddress
GetModuleHandleW
SystemTimeToFileTime
Sleep
GetCurrentProcess
Thread32Next
Thread32First
GetModuleHandleA
LoadLibraryA
VirtualProtectEx
OpenThread
HeapFree
lstrlenA
CreateFileW
HeapReAlloc
HeapAlloc
GetFileSize
GetProcessHeap
GetModuleFileNameA
GetModuleFileNameW
SetFilePointer
lstrcmpA
UnlockFileEx
LockFileEx
Wow64DisableWow64FsRedirection
ExpandEnvironmentStringsW
AreFileApisANSI
GetWindowsDirectoryW
GetCurrentDirectoryW
GlobalMemoryStatusEx
GetTickCount
GetFileAttributesW
GetSystemInfo
GetStdHandle
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
InitializeCriticalSection
GetFullPathNameA
SetEndOfFile
CreateMutexW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
FlushFileBuffers
RaiseException
DisableThreadLibraryCalls
SetEvent
CreateEventW
WriteConsoleW
SetStdHandle
QueryPerformanceFrequency
GetFileAttributesA
OpenProcess
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
WaitForSingleObject
GetCurrentProcessId
CopyFileA
lstrcatA
DeleteFileW
FindClose
GetTempPathW
DecodePointer
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetOEMCP
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
EncodePointer
Wow64RevertWow64FsRedirection
IsValidCodePage
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
GetFileType
ExitProcess
GetACP
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
RtlUnwindEx
InterlockedFlushSList
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
RtlPcToFileHeader

user32

GetCursorPos
FindWindowW

advapi32

RegOpenKeyExW
CryptReleaseContext
CryptAcquireContextW
CloseServiceHandle
OpenSCManagerW
EnumServicesStatusExW
RegQueryInfoKeyW
RegEnumKeyExW
CryptGenRandom
GetUserNameW
RegQueryValueExW
LookupPrivilegeValueW
RegCloseKey
RegSetValueExW
RegGetValueW
RegCreateKeyW
RegOpenKeyW

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize

oleaut32

SafeArrayGetUBound
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
SysAllocString
VariantClear
VariantInit

mpr

WNetGetProviderNameW

iphlpapi

GetAdaptersInfo

wtsapi32

WTSEnumerateProcessesA
WTSFreeMemory

wininet

InternetOpenUrlA
InternetCloseHandle
InternetReadFile
InternetOpenA

ws2_32

socket
htons
getsockname
inet_addr
WSACleanup
inet_ntop
connect
WSAStartup
freeaddrinfo
getaddrinfo
__WSAFDIsSet
ioctlsocket
getsockopt
closesocket
WSAGetLastError
WSASetLastError
setsockopt
send
select
recv
inet_ntoa

rpcrt4

RpcServerRegisterIfEx
RpcServerListen
RpcServerUseProtseqEpA
RpcMgmtStopServerListening
NdrServerCall2
RpcBindingFree
RpcServerUnregisterIf

Exports

Exports

dataCheck
setPath

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 418KB - Virtual size: 417KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 87KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

68a7a86448a19e2cda38fa737fa6ad40

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

mpr

iphlpapi

wtsapi32

wininet

ws2_32

rpcrt4

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 418KB - Virtual size: 417KB

.data Size: 87KB - Virtual size: 95KB

.pdata Size: 73KB - Virtual size: 72KB

.gfids Size: 2KB - Virtual size: 1KB

.tls Size: 5KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 418KB - Virtual size: 417KB

.data
Size: 87KB - Virtual size: 95KB

.pdata
Size: 73KB - Virtual size: 72KB

.gfids
Size: 2KB - Virtual size: 1KB

.tls
Size: 5KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 8KB