MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 287055194e83ab2a8d91ef4d187de57345c19018cf3a85024c4fd20c64ad689e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BumbleBee


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 287055194e83ab2a8d91ef4d187de57345c19018cf3a85024c4fd20c64ad689e
SHA3-384 hash: 573faae992007df2db5529fba25de272c08ebcc3aa154b1101444638654fdbde64306bf73d43e5e6297f5b79425d6291
SHA1 hash: 2efd0d398b648d5c70db7d15b1893eb19519ae74
MD5 hash: 546d975e638d044bc23c7f1bf4122d26
humanhash: hamper-fourteen-low-twelve
File name:projectr.dll
Download: download sample
Signature BumbleBee
Create hunting rule
File size:1'839'616 bytes
First seen:2022-06-24 09:41:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bc5a5f32b95a9bca825c469014d1df2d (4 x BumbleBee)
ssdeep 24576:k/9rgUo+Az8Yy7YdKuiU/78yy1Po60N035p1GB9+5zvXFNY5G+w3JrQsrnsU132F:OgUo+JeUdwfSk4u2
Threatray 2'258 similar samples on MalwareBazaar
TLSH T18B851A991482F320D9253CBA8C5D3EA4A2372F8F4E43DA24C170EDA1BBF6775A75C845
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter Rony
Tags:236a BUMBLEBEE exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
256
Origin country :
n/a
Vendor Threat Intelligence
Detection:
BumbleBee
Create hunting rule
Link:
https://www.capesandbox.com/analysis/283006/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Detecting VM
Using the Windows Management Instrumentation requests
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/62b58728a6ececa45fc61ddb/reports/56a32f3d-c941-43c5-9c55-2fdf4c7336d8/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/081c5d96-f8aa-40ab-8aae-3597658fe298
Result
Threat name:
BumbleBee
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1019234
Signature
Contain functionality to detect virtual machines
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Searches for specific processes (likely to inject)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected BumbleBee
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 651731 Sample: projectr.dll Startdate: 24/06/2022 Architecture: WINDOWS Score: 84 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected BumbleBee 2->33 35 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->35 8 loaddll64.exe 1 2->8         started        process3 signatures4 43 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->43 45 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 8->45 47 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->47 49 3 other signatures 8->49 11 regsvr32.exe 8->11         started        14 cmd.exe 1 8->14         started        16 rundll32.exe 8->16         started        18 2 other processes 8->18 process5 signatures6 51 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->51 53 Contain functionality to detect virtual machines 11->53 55 Searches for specific processes (likely to inject) 11->55 20 rundll32.exe 14->20         started        57 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->57 23 WerFault.exe 9 18->23         started        25 WerFault.exe 18->25         started        process7 signatures8 37 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 20->37 39 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 20->39 41 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 20->41 27 WerFault.exe 20 9 20->27         started        29 WerFault.exe 20->29         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/287055194e83ab2a8d91ef4d187de57345c19018cf3a85024c4fd20c64ad689e/
Threat name:
Win64.Trojan.Bumbleloader
Create hunting rule
Status:
Malicious
First seen:
2022-06-24 00:35:23 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
10 of 26 (38.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fbyfkgkoqovsvdmr55grq7pfonc4deayz45ikasmj7jayzfnncpa._file
Verdict:
malicious
Similar samples:
21bd2c88898f8fea3ba9dddb1c9e3cfb8f279d884099830dbda16acdde273587
BumbleBee
47fa907c50a09bc2fc41cf50afac4e178f7ce51c9592f18335db53976e87e92e
BumbleBee
a27dfea07887442cd18f7f52d3f28994e9b93631a998fe254a8bc654fad94b4e
BumbleBee
ccde5e528a8da994b3cd96a988023acd16a78a9cea4fe5dc1b41d9a72890a995
BumbleBee
e9b974d8bef3bbad04eb70f84f2102ca39faee208aea618fac76730f7d5d75bf
BumbleBee
ea52c881008e458daee5570c03b89726a0b3a652c26a3ec63002c82ba461e48c
BumbleBee
+ 2'248 additional samples on MalwareBazaar
Result
Malware family:
bumblebee
Create hunting rule
Score:
  10/10
Tags:
family:bumblebee botnet:236a evasion trojan
Link:
https://tria.ge/reports/220624-lpbx7secb7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Checks BIOS information in registry
Identifies Wine through registry keys
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
BumbleBee
Malware Config
C2 Extraction:
146.19.173.191:443
205.218.26.106:335
133.228.15.13:127
60.3.192.137:146
146.70.124.97:443
40.178.16.145:137
216.149.130.58:162
121.214.140.226:358
54.200.237.168:311
85.217.238.89:286
23.82.141.11:443
135.49.247.231:357
105.99.153.173:436
226.179.144.85:474
115.177.167.79:268
23.29.115.172:443
242.165.229.167:492
238.78.243.167:401
28.192.253.108:405
82.217.32.8:253
51.164.163.86:229
60.168.159.77:407
111.166.163.223:496
172.93.181.233:443
100.104.205.209:484
232.156.186.23:466
44.182.75.245:332
33.57.182.96:208
185.62.56.129:443
120.228.168.112:306
71.10.1.64:264
19.85.43.167:259
17.59.84.10:180
112.235.192.175:423
51.83.253.131:443
90.67.157.183:121
143.97.115.135:246
170.38.189.154:350
244.79.216.210:311
46.33.217.133:272
162.19.0.125:490
59.68.38.91:440
104.168.201.219:443
167.79.143.101:421
45.153.241.120:443
108.62.118.221:443
242.178.173.56:130
152.89.247.79:443
220.202.94.220:452
87.90.222.97:267
193.107.167.95:228
227.246.217.88:191
35.61.78.73:296
154.56.0.111:443
37.79.217.61:493
130.152.160.174:2
Unpacked files
SH256 hash:
287055194e83ab2a8d91ef4d187de57345c19018cf3a85024c4fd20c64ad689e
MD5 hash:
546d975e638d044bc23c7f1bf4122d26
SHA1 hash:
2efd0d398b648d5c70db7d15b1893eb19519ae74
Link:
https://www.unpac.me/results/6e001b24-8710-45a4-a118-5786665653cb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/287055194e83ab2a8d91ef4d187de57345c19018cf3a85024c4fd20c64ad689e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win64_bumbleebee_loader_packed
Create hunting rule
Author:Rony (@r0ny_123)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/283006/

Comments