bumblebee | 2026-10-31_5097c108a707a1b1068e2c3a69a4a1ec_coinminer_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_5097c108a707a1b1068e2c3a69a4a1ec_coinminer_icedid_njrat_ryuk
Size 1.1MB
Sample261031-ry1ktabz91
SHA256 34463c3ac891604d7c37e43f9318f8180b84e77fc55d91f8cd2ea438d2db7003
MD5 5097c108a707a1b1068e2c3a69a4a1ec
SHA1 cdd0729342b3e3fd130384e06714237fe6ccc78f
SHA512 dd8026329bbaf47d478b48f5906702a55aae59acb5a99198f6a9efb728ea9547cacf863271a861b9b5bc7cc8da832c6a38ff7b65a4f25527b8f46bce5c2824f0
SSDEEP 24576:tAZBB0pE2CwPwsqqSUZ57pBloBph3xbjrYWy2:pecDqqSOvloBPZj0F
TLSH
T1C3358D19AEA881E5D077C07889B5A557FBB1B85A5B348BDF0390461E3F736E04E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

is0210 loader bumblebee

Malware Config

Extracted

Family

bumblebee

Botnet

is0210

Attributes

dga
g7qf7ew5c.life

ibgrlnu1e.life

x5fnzbct1.life

1i2vp7bte.life

dflucrsh8.life

0f8ql4hr8.life

f9ftn74zw.life

nwm76e7b5.life

3hjqyzaex.life

v43qhl0mc.life

6aepjxcgi.life

4tbwu08rg.life

nzz3urf67.life

9xspr6w4a.life

oikdiug9o.life

vajo99879.life

5v7x1sqr4.life

57gqsekdz.life

5v5gciivx.life

33a1wkm3h.life

vt6xqpldf.life

t9lqm51rl.life

p75sz88kk.life

wz9ar8gpv.life

fdx4ra84n.life

nx37k4a6z.life

m8mczdgxv.life

wj7y0l4d9.life

hit0fdgit.life

82c6g5meu.life

v6s2bgwjy.life

axz9lii03.life

mect9esfe.life

63jgu7cc4.life

nvmct2zui.life

q6skdcbss.life

6d0v3982p.life

sdq9dz3el.life

hk7pts8c4.life

unbvfmj8m.life

icfdtd5kg.life

fpfegvuji.life

174nj83w4.life

iaw7acs0l.life

7ckqzdd3x.life

ijm0ed3k1.life

zf2n46wcv.life

lu6ejhqou.life

lwirapl73.life

qfk7wvaqu.life

4qnh6gcgq.life

txhc0jkvz.life

vqdomqhuu.life

pktl8qocp.life

k6151ybqq.life

7tvv8z14g.life

5qqfopla3.life

zrss2lw86.life

nm9t9jnct.life

cug2asazc.life

1lz092j54.life

krte45xa7.life

0jicug6ad.life

ayq1qslr5.life

jhsphzy91.life

yxlzsl1kb.life

6wd61b2x1.life

zuie54mzq.life

wmgficnz5.life

dg89us2b9.life

i36nu9vvk.life

88yyb0y7f.life

kt8167fc5.life

g8aydw1u5.life

iqjlr37zk.life

natsnrf8l.life

531sfiv6v.life

20g7eprtr.life

edr79crfe.life

f7t2o54dj.life

zmb1qz40y.life

7cg9hpaue.life

2kwd5uc8w.life

t3vg6n5hl.life

6g2hzw89g.life

zr36ks33v.life

4tgmylrhp.life

ziaiqy7o3.life

np01ddgsr.life

72p4wtl3w.life

l0085vigo.life

tkka4e7sw.life

dm5h2recb.life

v9mwukcoo.life

xzkqb6n29.life

xn2mvcgaf.life

buvo7auzc.life

ssbrpxmsv.life

5pxs3dote.life

tnol04fti.life
dga_seed_string
l0210lsk
domain_length
9
num_dga_domains
100
port
443
tld
.life

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Custom signature

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_5097c108a707a1b1068e2c3a69a4a1ec_coinminer_icedid_njrat_ryuk

File Explorer

2026-10-31_5097c108a707a1b1068e2c3a69a4a1ec_coinminer_icedid_njrat_ryuk

.exe 1.1MB

2026-10-31_5097c108a707a1b1068e2c3a69a4a1ec_coinminer_icedid_njrat_ryuk

IMPHASH 0e7d77b31705b90280a066941e785013
SHA256 34463c3ac891604d7c37e43f9318f8180b84e77fc55d91f8cd2ea438d2db7003
MD5 5097c108a707a1b1068e2c3a69a4a1ec
SHA1 cdd0729342b3e3fd130384e06714237fe6ccc78f
SHA512 dd8026329bbaf47d478b48f5906702a55aae59acb5a99198f6a9efb728ea9547cacf863271a861b9b5bc7cc8da832c6a38ff7b65a4f25527b8f46bce5c2824f0
SSDEEP 24576:tAZBB0pE2CwPwsqqSUZ57pBloBph3xbjrYWy2:pecDqqSOvloBPZj0F
TLSH
T1C3358D19AEA881E5D077C07889B5A557FBB1B85A5B348BDF0390461E3F736E04E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing combination of virtualization drivers
Detects executables referencing virtualization MAC addresses
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

359724

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shlwapi

PathCombineW StrCmpIW PathFindFileNameW PathRemoveExtensionW StrStrIW

kernel32

GetModuleFileNameA CreateEventW AreFileApisANSI ReadFile SetHandleInformation SetWaitableTimer TlsSetValue CreateNamedPipeA SetLastError EnterCriticalSection WriteFile TerminateProcess WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetQueuedCompletionStatus GetCurrentThreadId GetSystemDirectoryW PostQueuedCompletionStatus MultiByteToWideChar FormatMessageW GetLastError CreateFileA SetEvent TerminateThread TlsAlloc QueueUserAPC LocalFree DeleteCriticalSection VerSetConditionMask WideCharToMultiByte GetEnvironmentStrings SleepEx VerifyVersionInfoW TlsGetValue CreateProcessA TlsFree FormatMessageA CreateIoCompletionPort FreeEnvironmentStringsA GetExitCodeProcess GetProcAddress GetModuleHandleW Sleep GetCurrentProcess Thread32Next Thread32First GetModuleHandleA LoadLibraryA VirtualProtectEx OpenThread HeapFree lstrlenA CreateFileW HeapReAlloc HeapAlloc GetProcessHeap GetModuleFileNameW SetFilePointer lstrcmpA GetFileAttributesA Wow64DisableWow64FsRedirection ExpandEnvironmentStringsW Wow64RevertWow64FsRedirection GetWindowsDirectoryW GetCurrentDirectoryW GlobalMemoryStatusEx GetFileAttributesW GetStdHandle QueryPerformanceFrequency QueryPerformanceCounter RaiseException HeapSize WriteConsoleW WaitForSingleObject CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot GetCurrentProcessId CopyFileA lstrcatA FindClose SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW DecodePointer GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileA EncodePointer RtlPcToFileHeader CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind OpenProcess FindFirstFileExA GetTimeZoneInformation GetOEMCP IsValidCodePage SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType ExitProcess GetACP GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime

user32

GetCursorPos FindWindowW

advapi32

RegQueryValueExW CryptGenRandom CryptReleaseContext CryptAcquireContextW GetUserNameW CloseServiceHandle OpenSCManagerW EnumServicesStatusExW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW LookupPrivilegeValueW

shell32

SHGetSpecialFolderPathA SHGetSpecialFolderPathW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoInitializeSecurity CoUninitialize

oleaut32

SafeArrayGetUBound SafeArrayGetElement SafeArrayGetLBound SafeArrayUnaccessData SafeArrayAccessData SysFreeString SysAllocString VariantClear VariantInit

mpr

WNetGetProviderNameW

iphlpapi

GetAdaptersInfo

wtsapi32

WTSEnumerateProcessesA WTSFreeMemory

ws2_32

htons inet_addr inet_ntop closesocket recv send setsockopt WSAGetLastError connect socket WSAStartup getsockname getaddrinfo freeaddrinfo WSACleanup

rpcrt4

RpcServerRegisterIfEx RpcMgmtStopServerListening RpcServerListen NdrServerCall2 RpcBindingFree RpcServerUnregisterIf RpcServerUseProtseqEpA

Name

.text

Size

632KB

Virtual Size

631KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

275KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

74KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=13, id=241, version=40116,

count=160, id=243, version=40116,

count=25, id=242, version=40116,

count=30, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=8, id=259, version=24123,

count=65, id=261, version=24123,

count=39, id=260, version=24123,

count=1, id=206, version=65501,

count=3, id=208, version=65501,

count=1, id=259, productName=VS2015 UPD3 build 24210, version=24210,

count=3, productName=Unmarked objects (old),

count=29, id=203, version=65501,

count=275, id=1, productName=Unmarked objects,

count=58, id=265, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,