MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a1f783975c84eb09e79a4c0c984ec8a9aa4de8deeb3b03bec3877bf4629bae5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BumbleBee


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a1f783975c84eb09e79a4c0c984ec8a9aa4de8deeb3b03bec3877bf4629bae5
SHA3-384 hash: a559e92c6e5f2ae2984c486df0d7b43b65550cf3ec078b45882e7207e152fb31a95c8de44b355a9847b77d96be9a89b4
SHA1 hash: 7f42b71a953192dda0a4a98fceff62a7a2ae4409
MD5 hash: fedf94189d8864feba90916b94376a80
humanhash: blossom-oscar-robin-connecticut
File name:stats.dll
Download: download sample
Signature BumbleBee
Create hunting rule
File size:1'516'032 bytes
First seen:2022-06-29 16:34:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 33ffcdcf9962db8a714b2f6fb2e9b8f5 (1 x BumbleBee)
ssdeep 24576:c2LkP3ADZXLAGUqyDZwNDJEZR3fgikAsB3fB0m:c2LwSJsGLvJmk5fB0
Threatray 2'265 similar samples on MalwareBazaar
TLSH T1176512939EA9CED4CD315274126A03372A55F4AC16306F5BEFD8F436BE8BED02428749
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter pr0xylife
Tags:BUMBLEBEE exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
277
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Bumblebee Malware .zip
Verdict:
Suspicious activity
Analysis date:
2022-06-29 21:25:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/24d35f1f-c984-45f4-b767-2f2753f588d4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BumbleBee
Create hunting rule
Link:
https://www.capesandbox.com/analysis/284331/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Detecting VM
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/62bc7f7822ef321587b869dc/reports/ff0679c0-b3b1-421d-94f2-72415cc7de38/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9d3778af-6b0e-41c0-a8cf-68cbaf2f1a8d
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1022032
Signature
Contain functionality to detect virtual machines
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Searches for specific processes (likely to inject)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 654534 Sample: stats.dll Startdate: 29/06/2022 Architecture: WINDOWS Score: 68 35 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->35 8 loaddll64.exe 1 2->8         started        process3 signatures4 43 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->43 45 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 8->45 47 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->47 49 3 other signatures 8->49 11 regsvr32.exe 8->11         started        14 cmd.exe 1 8->14         started        16 rundll32.exe 8->16         started        18 2 other processes 8->18 process5 signatures6 51 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->51 53 Contain functionality to detect virtual machines 11->53 55 Searches for specific processes (likely to inject) 11->55 20 rundll32.exe 14->20         started        57 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->57 23 WerFault.exe 20 9 18->23         started        25 WerFault.exe 9 18->25         started        27 WerFault.exe 18->27         started        29 WerFault.exe 18->29         started        process7 signatures8 37 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 20->37 39 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 20->39 41 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 20->41 31 WerFault.exe 9 20->31         started        33 WerFault.exe 20->33         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a1f783975c84eb09e79a4c0c984ec8a9aa4de8deeb3b03bec3877bf4629bae5/
Threat name:
Win64.Dropper.BumbleBee
Create hunting rule
Status:
Malicious
First seen:
2022-06-29 16:35:11 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
19 of 41 (46.34%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bipxqolvzbhlbhtzutamtbhmrknkjxun52z3ao7mhb336rrjxlsq._file
Verdict:
malicious
Similar samples:
21bd2c88898f8fea3ba9dddb1c9e3cfb8f279d884099830dbda16acdde273587
BumbleBee
287055194e83ab2a8d91ef4d187de57345c19018cf3a85024c4fd20c64ad689e
BumbleBee
b29b0f2a27ccbb9f12363a3dde1f2d2373fdc782232f4804f0abffbb8daf9d25
BumbleBee
e53559c78dd327bd53cd47635c73d57273c3e0a809c7bee8d3353b3903d7c2ff
BumbleBee
f3d6cc38e35b0738ac5968f8c15404bbe17a1cc00cd6af03b99942e3d9174c8e
BumbleBee
fed9bc8df9141f8f8f7a9203bc26b5b22123c154702fcd625379f2f7ecd31cb2
BumbleBee
+ 2'255 additional samples on MalwareBazaar
Result
Malware family:
bumblebee
Create hunting rule
Score:
  10/10
Tags:
family:bumblebee botnet:276l evasion trojan
Link:
https://tria.ge/reports/220629-t3m7dsbbbl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Checks BIOS information in registry
Identifies Wine through registry keys
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
BumbleBee
Malware Config
C2 Extraction:
172.93.193.124:443
45.153.241.64:443
45.153.241.19:443
Unpacked files
SH256 hash:
0a1f783975c84eb09e79a4c0c984ec8a9aa4de8deeb3b03bec3877bf4629bae5
MD5 hash:
fedf94189d8864feba90916b94376a80
SHA1 hash:
7f42b71a953192dda0a4a98fceff62a7a2ae4409
Link:
https://www.unpac.me/results/ae5b4749-a088-4b13-9f41-f06f5d5ca1b6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0a1f783975c84eb09e79a4c0c984ec8a9aa4de8deeb3b03bec3877bf4629bae5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BumbleBeeLoader
Create hunting rule
Author:enzo & kevoreilly
Description:BumbleBee Loader
Rule name:crime_win64_bumbleebee_loader_packed
Create hunting rule
Author:Rony (@r0ny_123)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/284331/

Comments