Extracted

• • Target

    e63911bf851f892bab6d3933349a987e.msi

  • Size

    4.7MB

  • MD5

    e63911bf851f892bab6d3933349a987e

  • SHA1

    c3f5bd1aca61bd086f1aea3e4b86419a836888ce

  • SHA256

    b8794c9251e2c6fbb96c458a5e1821ddd029335933dfbb03efa7db63673562e8

  • SHA512

    f00874b37580152bbb563b29763212de0452e8117f54e4199150cb8cebf3f4d8d1c31ed28d896b7b0cbb63c17e8847019ed76b53f7c0ae07021527705e1af17c

  • SSDEEP

    49152:37Vh102T9dhkuqES58NtvUoBV0Sccd2b5+pnQ2fP1r8+/J4OV7AEqj7D4Uv6ZCOX:37VTVkufFN0ScaruSmHR9vaXZTUa3vg

  Score

  10^/10

  bumblebee1discoveryloaderpersistenceprivilege_escalation

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Bumblebee family

    bumblebee

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2