bumblebee | 46279bf47f037c5e05e84ecd3aa6f7c0074696bfe0ccb8df4781033e79e8aa1d

Sharing

Copy URL Twitter E-mail

General

Target
tmpvtlb_eo8
Size 5.3MB
Sample260609-bak78aav6k
SHA256 46279bf47f037c5e05e84ecd3aa6f7c0074696bfe0ccb8df4781033e79e8aa1d
MD5 f58e3b05bb9e467bc013a21d3114908d
SHA1 b14cdd98caa179f9f3865396720b4be727f4a20c
SHA512 e413105e3ddeba534fbd1698c15125882be9c2a4bcda6e05dc964bd7ddfb37233dc869b572db0789fbde051ea7e574f0b20c9a0bf4f16c5fc6ab4f5957000dbd
SSDEEP 98304:LHrk3bVI2OzboNeQBWkl43yRev9CcTnuKUUainpK3F63SzzWzsphnm:3sq5zboN6F9BLubqpG6Cuzsph
TLSH
T11346332DA1D48FF4D6893332899D38778E5CDD94F0A7EC05664373222A74E680E35BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

bumblebee

Botnet

10112

Attributes

dga
vca3utda017.click

knvop5puf3w.click

fuoor4i9488.click

e27y0btovqa.click

4td54jwr0zo.click

8u1tf686x8r.click

7rbvv9nr7ux.click

0qlcz1igan7.click

1ywg4j0oomt.click

uk2cx2bz9oh.click

mmh6zjh9rws.click

tyv7socu189.click

nu1ry3ywid2.click

qbjc9488vee.click

v8tarf4uflp.click

nubhcl6uvd6.click

pj2h7xw21zx.click

n22xrd1xrto.click

1age5rpmnbq.click

s7ebb7t79vn.click

t8vxfebri9r.click

77ch3dlvcuc.click

4k2znm7tg08.click

ie4jzevdaka.click

pweekbw7x9i.click

dg4j9l1r2ay.click

6linr1ga29p.click

ae4fgatomcn.click

i0rwy7k6rh8.click

zrvvmchlzab.click

ld6w0ra2n5v.click

0iy3kqu94si.click

a2h8x65mhmb.click

n8sbjfep5yd.click

mxnz6y6v6it.click

tj17eq1yv9p.click

ih1fzdij3lw.click

trjwgh2g6wj.click

uecqk6x4j8t.click

b2fqqlxq123.click

efu7sqzes6x.click

7avrr81op36.click

yn20wnog91u.click

gypx84c0psc.click

tiitp659yg7.click

xdfbgydlc05.click

zpz5jkazftt.click

w5o0gvbo6gz.click

u4fhmu65x9q.click

mwu8dx0r8l6.click

hwcnz0dhias.click

zj7zlpwpgk2.click

es6fj45yryo.click

vfhfp5pv5jq.click

n6uv59241o8.click

vxg5zt80xk1.click

f8vdyr368rr.click

u0hs21xo0oj.click

lk34zp37aa8.click

qbn8ng1n4y6.click

anwx8vvu2tn.click

amwy9i160dz.click

mhd2v73drk9.click

e64hgph4fpf.click

gisulurnufk.click

wsswivqef2j.click

tay4gok6gyf.click

2wbw7n1xihz.click

otuk9puv3dy.click

8ra21ma0ldn.click

6wo9w60mg4p.click

119qwh18wha.click

88crnaq8rxq.click

l52j1936qx7.click

0ffmtln7j1y.click

c2h9uj4rq5j.click

99e0wxgydv3.click

8x4zwderijh.click

aoh4pifqjfw.click

pfga45i3mid.click

6u8p3dxuusp.click

73wkg93t6yb.click

9d2285jpz2p.click

q8h20fokn7m.click

sjq07uvdff3.click

kmm14f207e0.click

96l0jwdfwsf.click

5t86twnzcmf.click

jgyffzjilwz.click

gb52rzeqsel.click

jsnwvpzo96y.click

5ijbx337vd2.click

e107j7ub2do.click

2plnxces98r.click

6r3ypuoxg63.click

kmmfsxcqiyv.click

2aecwymugah.click

s38tusi2x3c.click

lznvqhcqtqs.click

wnmatvjf2h9.click
dga_seed
7827833623176771557
domain_length
11
num_dga_domains
300
port
443
tld
.click

rc4.plain

Targets

- Target
  tmpvtlb_eo8
- Size 5.3MB
- SHA256 46279bf47f037c5e05e84ecd3aa6f7c0074696bfe0ccb8df4781033e79e8aa1d
- MD5 f58e3b05bb9e467bc013a21d3114908d
- SHA1 b14cdd98caa179f9f3865396720b4be727f4a20c
- SHA512 e413105e3ddeba534fbd1698c15125882be9c2a4bcda6e05dc964bd7ddfb37233dc869b572db0789fbde051ea7e574f0b20c9a0bf4f16c5fc6ab4f5957000dbd
- SSDEEP 98304:LHrk3bVI2OzboNeQBWkl43yRev9CcTnuKUUainpK3F63SzzWzsphnm:3sq5zboN6F9BLubqpG6Cuzsph
- TLSH
  T11346332DA1D48FF4D6893332899D38778E5CDD94F0A7EC05664373222A74E680E35BE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

10112 discovery bumblebee loader persistence privilege_escalation ransomware
- Family: BumbleBee
  BumbleBee is a loader malware written in C++.
  loader bumblebee
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2 behavioral3