MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BumbleBee


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f
SHA3-384 hash: 5401ea4d5f11b56cb38726ba13699dba6b52bbee09943eb57e325385a74a4ebbac274b494347a2878ed61736cb31ea7d
SHA1 hash: de9ac17fc24f49f1449935f19a532b73efbc44c1
MD5 hash: 704dc6051ef3851b218c098541823ad0
humanhash: pennsylvania-quebec-queen-alabama
File name:WinMTR.msi
Download: download sample
Signature BumbleBee
Create hunting rule
File size:3'563'520 bytes
First seen:2025-05-19 23:34:29 UTC
Last seen:2025-05-20 20:09:47 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:8UbQJAZHOnBIJKR35mSLRG90srYWVBHRkf1Em6b7s95yT241J+k4i8k1j7surg:8U8uEL5mSLRW0sZHRYakoT24ST5kZgH
Threatray 33 similar samples on MalwareBazaar
TLSH T125F53382E6CC0F3AD68BC731475FC9849938DD94EA990350261E72EC6B773913B78897
TrID 88.4% (.MST) Windows SDK Setup Transform script (61000/1/5)
11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter Anonymous
Tags:BUMBLEBEE LLC-Best-Consult msi signed

Code Signing Certificate

Organisation:LLC Best Consult
Issuer:GlobalSign GCC R45 EV CodeSigning CA 2020
Algorithm:sha256WithRSAEncryption
Valid from:2025-05-14T15:23:53Z
Valid to:2026-05-15T15:23:53Z
Serial number: 1044dc08d7a1cead020b97ec
Intelligence: 7 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 5ce814f2c915eb20b8f72ac54b7d0a3a4756e80cf6d60a7525268ed8df4965ec
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
146
Origin country :
MX MX
Vendor Threat Intelligence
Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=682bc048c28c67d666422477
Tags:
shellcode spawn
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
installer invalid-signature signed
Link:
https://www.filescan.io/uploads/682bc044c609634bd7ca1423/reports/6acb94a6-7578-4b4e-b5e4-d069442bcfc7/overview
Verdict:
Suspicious
Labled as:
Trojan.MSI.Agent
Link:
https://www.hybrid-analysis.com/sample/02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
BumbleBee
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1694396
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to prevent local Windows debugging
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found WinMTR tool (often used for host & network discovery)
Malicious sample detected (through community Yara rule)
Queries random domain names (often used to prevent blacklisting and sinkholes)
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected BumbleBee
Behaviour
Behavior Graph:
Download SVG
Score:
87%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f
Threat name:
Win32.Trojan.BumbleBee
Create hunting rule
Status:
Malicious
First seen:
2025-05-19 23:35:04 UTC
File Type:
Binary (Archive)
Extracted files:
45
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aimxyi5pd6m4h6sb2uxx7es6i6xfx626mbbrjumtqky3w4isiy7q._file
Verdict:
malicious
Label(s):
bumblebee
Create hunting rule
Similar samples:
02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f
BumbleBee
0ab5b3e9790aa8ada1bbadd5d22908b5ba7b9f078e8f5b4e8fcc27cc0011cce7
BumbleBee
27487060866209922c13a92bbcc3457fbbf977f5aaff25e199778e8a023d9c24
BumbleBee
281e07af77e1ff21140a7102c3cf8802dff96e670c8c3c73b8250d487a5196ed
BumbleBee
39f609e59d6bbb9e705ae430de6eb6e92cee2e722d74f4369cc6ff7c601809a7
BumbleBee
783a4034e44f58427a248454ade7ab09c4099414bb0a385ca32d8b263cd21ae4
BumbleBee
error
BumbleBee
f82d15eed385a7a913b98a28bce9b27a7e3611e1c0c4d9fa65741d3fdd76d23c
BumbleBee
+ 23 additional samples on MalwareBazaar
Result
Malware family:
bumblebee
Create hunting rule
Score:
  10/10
Tags:
family:bumblebee botnet:grp0004 loader persistence privilege_escalation
Link:
https://tria.ge/reports/250519-3kvyys1rx4/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Enumerates connected drives
Looks up external IP address via web service
BumbleBee
Bumblebee family
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/f6ce9831-5d7b-4e49-b2dd-b277441a283c
Malware family:
BumbleBee
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/02197c23af1f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BumbleBee

Microsoft Software Installer (MSI) msi 02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f

(this sample)

  
Delivery method
Distributed via web download

Comments