MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27487060866209922c13a92bbcc3457fbbf977f5aaff25e199778e8a023d9c24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BumbleBee

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	27487060866209922c13a92bbcc3457fbbf977f5aaff25e199778e8a023d9c24
SHA3-384 hash:	5ca31b048b9bb6e8650a32899c73db916c4939f62e8eeb438189753795ba052ebc25fc2820c15e9f9af41bfab1a541ef
SHA1 hash:	67d6e46cf006d34d7606c03f48052fcd7af58d86
MD5 hash:	bd99a02d8afdc468d315d47870202198
humanhash:	ack-wisconsin-fruit-july
File name:	RVTools.msi
Download:	download sample
Signature	BumbleBee Create hunting rule
File size:	9'752'576 bytes
First seen:	2025-04-17 12:13:18 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	196608:YKhpGIqbo0qpUd5DxbN9QZc1GmbL8bdeIlntj/8/Vy5XgLF9fmR2Q:Y+RGdt0ckmcb8IltzvxgTm
Threatray	90 similar samples on MalwareBazaar
TLSH	T17EA6336E3BB8A70BC73E75B499931280804EACD352C8F846F25DF7A833787606E55356
TrID	88.4% (.MST) Windows SDK Setup Transform script (61000/1/5) 11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	abuse_ch
Tags:	BUMBLEBEE msi signed

Code Signing Certificate

Organisation:	LLC Alliance
Issuer:	GlobalSign GCC R45 EV CodeSigning CA 2020
Algorithm:	sha256WithRSAEncryption
Valid from:	2025-03-24T13:34:02Z
Valid to:	2026-03-25T13:34:02Z
Serial number:	39111d565c62321e447f9b5e
Intelligence:	3 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:	This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:	This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:	SHA256
Thumbprint:	a52d4fb335c95b6f0aa4019c3f135519f71141b34a9b158d1a0c083d72f86515
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/2699/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6800f12e280f5f89a0d06edc

Tags:

shellcode virus blic

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

bumblebee installer invalid-signature revoked-cert signed

Link:

https://www.filescan.io/uploads/6800f06590767142c3d8f76f/reports/03957e4f-fa02-42e7-9366-c22101a40de2/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/27487060866209922c13a92bbcc3457fbbf977f5aaff25e199778e8a023d9c24

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/27487060866209922c13a92bbcc3457fbbf977f5aaff25e199778e8a023d9c24

Result

Threat name:

BumbleBee

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1667481

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contain functionality to detect virtual machines

Contains functionality to determine the online IP of the system

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Queries random domain names (often used to prevent blacklisting and sinkholes)

Searches for specific processes (likely to inject)

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected BumbleBee

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Result

Malware family:

bumblebee

Score:

10/10

Tags:

family:bumblebee botnet:rvt1 loader persistence privilege_escalation

Link:

https://tria.ge/reports/250417-pdxmbattfx/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Event Triggered Execution: Installer Packages

Blocklisted process makes network request

Enumerates connected drives

BumbleBee

Bumblebee family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/4858c775-b11a-4f6d-92d6-be729715e9ef

Malware family:

BumbleBee

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/274870608662/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	maldoc_OLE_file_magic_number Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)