bumblebee

Resubmissions

10/02/2025, 11:33

250210-nn9h7azjgr 6

10/02/2025, 10:58

250210-m2xacayngp 10

05/02/2025, 03:33

250205-d4n73sypdj 6

Sharing

Copy URL

Twitter E-mail

General

Target

31b72e1c246b4f38e70f9c8c556a626b15736589860f3231001bb4ebae749239.msi
Size

8.2MB
Sample

250210-m2xacayngp
MD5

2df80283a8c95b24b9c057bc8274c14b
SHA1

ed61db573ef82b42d519aefff15ee157054ed158
SHA256

31b72e1c246b4f38e70f9c8c556a626b15736589860f3231001bb4ebae749239
SHA512

03193a2986bf6f5c3bd6dc38e4b47bf5d7070f45fe1dfa8c54158abf3366a28afa45c1bf9039798a9a350f848f7d6eb58b6c656b88b0be8a08190ff4bf5cd67f
SSDEEP

196608:qYArVsCUdqt33xvKkkar0JxzvoMjsLrYu7KDxn:qYgVsCb3VbozvmYsKV

Score

10^/10

Malware Config

Extracted

Family

bumblebee

Botnet

9090

Attributes

dga
nvg55tpgvn.click

ulbun31qmv.click

7oc6be5fmy.click

bm76b9296k.click

h7xupkk0d3.click

fi7anseaj7.click

0u4bcayb8u.click

1cckgd13z5.click

562z75s3bp.click

1smmlbbiqr.click

cc5fi2q6ca.click

xisdha07tt.click

rvi6iv6l5v.click

kddpj0gryr.click

jmpxjjqhe8.click

ui1b0rvu0k.click

kqiqovthoj.click

zbldvupsdc.click

qdhqoj9s20.click

g841i9ksgn.click

uu4cx79e90.click

m9a2qfmqay.click

kc8svtokry.click

st9rdv9xai.click

i4965hr9jc.click

wkxfgjwonu.click

53y5nwsc6j.click

7ou7og586r.click

r5wrzrk1bi.click

am7gd0loc1.click

a2cey1j0xl.click

il1nlb7tn0.click

d7x2whgood.click

b5sqn635n9.click

nox7lvewcl.click

5buum8t9vl.click

fb25x2ju7i.click

ral9rhuaxy.click

mt9ycu98jr.click

8vndou1xlz.click

ul6105p00e.click

9hqid2tzng.click

lxw6duivu7.click

0dhalnnwr5.click

p6xuzncl71.click

lwpk3miw9n.click

t792ufhvll.click

o0fivl26q7.click

hmh20ykvlf.click

ixu6xial6v.click

dv14q2l82c.click

wz4pnl68jg.click

6709v1hcy1.click

x0822sepnx.click

ft8qxfxurc.click

64ud5xnryz.click

gflgt8sbzn.click

27c28lnp3v.click

g2to6sz5pi.click

i76uhrb930.click

h3p2sxyyk8.click

g90uubdr4p.click

nmgyqyrb8b.click

a53faphpe4.click

2wqfxxycnk.click

xa7wlz3r5y.click

27v2bofhl4.click

uc38lfln1t.click

akk5t6frjq.click

kiuxl1yijx.click

689c3d8ylq.click

3j6smer0tm.click

b8w2qcig4n.click

85ciukct31.click

b4j8gnyy3a.click

roc72ievev.click

3sehf3t4x5.click

hztr0qlwke.click

vig3u2t4fm.click

ehca1iots2.click

b4c6xa0j4f.click

y65z9jsgrh.click

a9ph8qf8d6.click

lp09sfynbd.click

62dp72sdft.click

7y2yvpkuff.click

y3hhmeydtr.click

kh2e843low.click

bao2cdlwd0.click

ufbt7kts4x.click

dls5ae3bfp.click

cbwsfxcdei.click

56azbsx5nm.click

rjafv9rkqq.click

cjbdm0nhub.click

xt58p1nya3.click

6y3igtg9t6.click

4q3m78acq6.click

rjj19c1jpn.click

nepygxz419.click
dga_seed
-5372979216912523469
domain_length
10
num_dga_domains
300
port
443
tld
.click

rc4.plain

Targets

- Target
  
  31b72e1c246b4f38e70f9c8c556a626b15736589860f3231001bb4ebae749239.msi
- Size
  
  8.2MB
- MD5
  
  2df80283a8c95b24b9c057bc8274c14b
- SHA1
  
  ed61db573ef82b42d519aefff15ee157054ed158
- SHA256
  
  31b72e1c246b4f38e70f9c8c556a626b15736589860f3231001bb4ebae749239
- SHA512
  
  03193a2986bf6f5c3bd6dc38e4b47bf5d7070f45fe1dfa8c54158abf3366a28afa45c1bf9039798a9a350f848f7d6eb58b6c656b88b0be8a08190ff4bf5cd67f
- SSDEEP
  
  196608:qYArVsCUdqt33xvKkkar0JxzvoMjsLrYu7KDxn:qYgVsCb3VbozvmYsKV
Score

10^/10

discovery persistence privilege_escalation bumblebee 9090 defense_evasion loader trojan
- BumbleBee
  BumbleBee is a loader malware written in C++.
  loader bumblebee
- Bumblebee family
  bumblebee
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Blocklisted process makes network request
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2 behavioral3 behavioral4