General

  • Target

    2025-01-01_f4f6419b3b1db8b549660eccdd397be9_ryuk

  • Size

    5.0MB

  • Sample

    250101-h8pfvsylax

  • MD5

    f4f6419b3b1db8b549660eccdd397be9

  • SHA1

    a3e2f9e5e25d165ee2ccd2dc115c324a8dede139

  • SHA256

    02a4709111b67da14020216103d7cec2aec3587234fd21914db6430c8cd81f65

  • SHA512

    16e24df51b6a6ac4712282496c42255ac7ff165bd57b4e520a53af7935311928adc5c4ea7526a3819279840fed103317becf9ffa3989ba1e686a2f2f8d5192dd

  • SSDEEP

    49152:FraFkK0lzGzoWFI7/U+9l3TIbh0f/NHqoW2qCQUVtnbcdeQhancG:lmk7lzeoWqg0fdsdecann

Score
10/10

Malware Config

Extracted

Family

bumblebee

Botnet

933

Attributes
  • dga

    9qlg6ojje0fh.life

    t120o0lqyzjk.life

    etptzwxsyp32.life

    r8odycmtgooa.life

    nb56cfxd01nr.life

    xyz5fpz6im57.life

    y4yhop208nes.life

    cvggxnytt623.life

    7zaolm729xjw.life

    fkgm8tb8fwky.life

    rqyuhu82y5ro.life

    rato5okc78nh.life

    c1yp2qhm7efl.life

    5vi9zf66i5rn.life

    ydi1tars4qo5.life

    l1bfvyx5yr8e.life

    s5lxi812qbt5.life

    37jnlxcobt19.life

    1uwsarbntiak.life

    x5mbn2n8j0wn.life

    r3geabq7zf8o.life

    lxsq535scirs.life

    vuftqxjdst36.life

    ks4bjt91jriw.life

    zj9lg3qke1k5.life

    0ndr4p83d77l.life

    ykk98pvhd6jy.life

    dlkim3cw0wt8.life

    tliy48rr6fi7.life

    xk9g4w9g1m0o.life

  • dga_seed

    3171302928008992269

  • domain_length

    12

  • num_dga_domains

    300

  • port

    443

rc4.plain

Targets

    • Target

      2025-01-01_f4f6419b3b1db8b549660eccdd397be9_ryuk

    • Size

      5.0MB

    • MD5

      f4f6419b3b1db8b549660eccdd397be9

    • SHA1

      a3e2f9e5e25d165ee2ccd2dc115c324a8dede139

    • SHA256

      02a4709111b67da14020216103d7cec2aec3587234fd21914db6430c8cd81f65

    • SHA512

      16e24df51b6a6ac4712282496c42255ac7ff165bd57b4e520a53af7935311928adc5c4ea7526a3819279840fed103317becf9ffa3989ba1e686a2f2f8d5192dd

    • SSDEEP

      49152:FraFkK0lzGzoWFI7/U+9l3TIbh0f/NHqoW2qCQUVtnbcdeQhancG:lmk7lzeoWqg0fdsdecann

    Score
    10/10
    • BumbleBee

      BumbleBee is a loader malware written in C++.

    • Bumblebee family

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks