General

  • Target

    Report_1eed5c99-5474-4156-a3c8-a5537ffea449.js

  • Size

    42KB

  • Sample

    241022-zwymfawdlq

  • MD5

    c77a5b4849df9ec7bdcdf970504c6bf5

  • SHA1

    cea1a6eff08bf3c54eb889af265b0f62f6897cf9

  • SHA256

    3df813c5990e6bf7a841b1ecac9e224903e37a3f8e32d63b9816c3507aab5637

  • SHA512

    a24a3ca285cd942f1170f75ceb23a97c441cf7694b53af8e5c1c880e5ff6bbddde50f78e28a97785276998b5c7646ffccb34d5e2d0f13fe8a85acaa80f8bf98e

  • SSDEEP

    768:2/OWgWxiLG0nMLTYFFd4SCEA4iuxbSHsH0G4SCS64TN+n6AmiY7BTER/Xzb1ql83:zBgR/Xzb1qblhoooLCk+TBUVDiwQ+pa2

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://mycocojamboo.com/bgfhfg/lGmEQCgpfT.dll

Extracted

Family

bumblebee

Botnet

lnk001

Attributes
  • dga

    tvx1ovdepj8.life

    acgr6r8zdot.life

    ilofx941igp.life

    8x2apo5m7ri.life

    x9yrzer0ndt.life

    93j4v4jopzd.life

    ameagxzo2f7.life

    nyy41uibsv5.life

    ru4jvijdytq.life

    l9t6r0y6cvi.life

    f4vb9n3tdvh.life

    9do3mcejztt.life

    pxu1ajsdhqr.life

    7exy2b231n2.life

    vu5b47m18jn.life

    6mnudp7zj73.life

    p5047yjrb8q.life

    d0xtxp89bb9.life

    ygo9u1fkwux.life

    fig3gj0v6qe.life

    38f5wvwwn7o.life

    txgogs9p8a1.life

    uyn0icgx1kv.life

    2z1ls31az7s.life

    0cc2z8zrnhf.life

    fsr2hskx44p.life

    du19ek78tjw.life

    234ct3lkozp.life

    he8fq4k8d3w.life

    7ewh8ltr7il.life

  • dga_seed

    1016365528594956469

  • domain_length

    11

  • num_dga_domains

    100

  • port

    443

rc4.plain

Targets

    • Target

      Report_1eed5c99-5474-4156-a3c8-a5537ffea449.js

    • Size

      42KB

    • MD5

      c77a5b4849df9ec7bdcdf970504c6bf5

    • SHA1

      cea1a6eff08bf3c54eb889af265b0f62f6897cf9

    • SHA256

      3df813c5990e6bf7a841b1ecac9e224903e37a3f8e32d63b9816c3507aab5637

    • SHA512

      a24a3ca285cd942f1170f75ceb23a97c441cf7694b53af8e5c1c880e5ff6bbddde50f78e28a97785276998b5c7646ffccb34d5e2d0f13fe8a85acaa80f8bf98e

    • SSDEEP

      768:2/OWgWxiLG0nMLTYFFd4SCEA4iuxbSHsH0G4SCS64TN+n6AmiY7BTER/Xzb1ql83:zBgR/Xzb1qblhoooLCk+TBUVDiwQ+pa2

    • BumbleBee

      BumbleBee is a loader malware written in C++.

    • Bumblebee family

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks