bumblebee | 16a0603120b33dd7decdccd0b2df8764ed168b1a920a5dff10549a9608839300

General

Target
2026-10-06_bf467bf60944a656d3254e9731554311_icedid_ryuk
Size 931KB
Sample261007-zbqq4aws6r
SHA256 16a0603120b33dd7decdccd0b2df8764ed168b1a920a5dff10549a9608839300
MD5 bf467bf60944a656d3254e9731554311
SHA1 2fc60b821e65e182a0e2fed14e8330aedd758681
SHA512 49d6adfb7c5dedf63ad8bfa53c99cc40ec5476605cb10f5cfe02489937c840e43df342694603549cdc20d59581739f1b08cd1c714860d23bb9ad3395573b1ed6
SSDEEP 24576:7uEYpL6eGotXnc1lus5nY+7B+FfJoiXygld/gr:7u1L6Rkn2ws5nRNoygK
TLSH
T19A15021056A215EFD4364273C9929D76BAB07CD743224B3B1BA707362E1F7C45E3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

bumblebee

Botnet

17maca

C2

108.62.141.20:443
23.108.57.201:443
108.62.118.170:443

rc4.plain

Targets

- Target
  2026-10-06_bf467bf60944a656d3254e9731554311_icedid_ryuk
- Size 931KB
- SHA256 16a0603120b33dd7decdccd0b2df8764ed168b1a920a5dff10549a9608839300
- MD5 bf467bf60944a656d3254e9731554311
- SHA1 2fc60b821e65e182a0e2fed14e8330aedd758681
- SHA512 49d6adfb7c5dedf63ad8bfa53c99cc40ec5476605cb10f5cfe02489937c840e43df342694603549cdc20d59581739f1b08cd1c714860d23bb9ad3395573b1ed6
- SSDEEP 24576:7uEYpL6eGotXnc1lus5nY+7B+FfJoiXygld/gr:7u1L6Rkn2ws5nRNoygK
- TLSH
  T19A15021056A215EFD4364273C9929D76BAB07CD743224B3B1BA707362E1F7C45E3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

17maca defense_evasion discovery bumblebee loader
- Family: BumbleBee
  BumbleBee is a loader malware written in C++.
  loader bumblebee
- Detects executables referencing combination of virtualization drivers
- Detects executables referencing virtualization MAC addresses
- Suspicious use of NtCreateThreadExHideFromDebugger
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

1

T1622

Credential Access

Discovery

Debugger Evasion

1

T1622

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: BumbleBee

Detects executables referencing combination of virtualization drivers

Detects executables referencing virtualization MAC addresses

Suspicious use of NtCreateThreadExHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2