MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65e4da53beeeef0e8b00ec86fda5e63b653005b3d2e22183053f2cc220532f03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BumbleBee


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65e4da53beeeef0e8b00ec86fda5e63b653005b3d2e22183053f2cc220532f03
SHA3-384 hash: 75cc037a7fdb1fe39525f770a33df013c6ebe318fe290d5ab100318ef9e22d6153f97d8aeec6f860b5163c6588ee276f
SHA1 hash: f4af8b1da2657ecba5c93525b8537494993dc487
MD5 hash: f173a3aa88b213bd68588f02ddd37860
humanhash: river-indigo-kilo-minnesota
File name:5a8d46.msi
Download: download sample
Signature BumbleBee
Create hunting rule
File size:9'691'136 bytes
First seen:2025-04-16 22:53:57 UTC
Last seen:2025-04-17 11:09:28 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:pKhpGIqbo0qpUd5DxbN9QZc1GmbL8bdeIlntj/8/VicItycXb8fRJ:p+RGdt0ckmcb8Iltzf98fv
Threatray 87 similar samples on MalwareBazaar
TLSH T1D3A6331AB7ACF707D33E74B8957612D0448EACC223D4F587E15AF3E831353B46AA8259
TrID 88.4% (.MST) Windows SDK Setup Transform script (61000/1/5)
11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter g0njxa
Tags:BUMBLEBEE LLC Alliance msi signed

Code Signing Certificate

Organisation:LLC Alliance
Issuer:GlobalSign GCC R45 EV CodeSigning CA 2020
Algorithm:sha256WithRSAEncryption
Valid from:2025-03-24T13:34:02Z
Valid to:2026-03-25T13:34:02Z
Serial number: 39111d565c62321e447f9b5e
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: a52d4fb335c95b6f0aa4019c3f135519f71141b34a9b158d1a0c083d72f86515
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
ES ES
Vendor Threat Intelligence
Detection:
BumbleBee
Create hunting rule
Link:
https://www.capesandbox.com/analysis/2542/
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68003953280f5f89a0cfebd6
Tags:
shellcode virus blic
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypt installer invalid-signature signed
Link:
https://www.filescan.io/uploads/6800351090767142c3d80136/reports/8679f72f-3398-46e1-b390-90985d85e59c/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/65e4da53beeeef0e8b00ec86fda5e63b653005b3d2e22183053f2cc220532f03
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/65e4da53beeeef0e8b00ec86fda5e63b653005b3d2e22183053f2cc220532f03
Result
Threat name:
BumbleBee
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1666829
Signature
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Contains functionality to determine the online IP of the system
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Queries random domain names (often used to prevent blacklisting and sinkholes)
Searches for specific processes (likely to inject)
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected BumbleBee
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/65e4da53beeeef0e8b00ec86fda5e63b653005b3d2e22183053f2cc220532f03
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65e4da53beeeef0e8b00ec86fda5e63b653005b3d2e22183053f2cc220532f03/
Threat name:
Win64.Trojan.Bumbleloader
Create hunting rule
Status:
Suspicious
First seen:
2025-04-09 20:25:50 UTC
File Type:
Binary (Archive)
Extracted files:
394
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mxsnuu5653xq5cya5sdp3jpghnstabnt2lrcdayfh4wmeictf4bq._file
Verdict:
malicious
Label(s):
bumblebee
Create hunting rule
Similar samples:
1b366d453cf19c880fe64b2d0654b9e500ea92c66249cf7b540a21b843494aae
BumbleBee
1b7cffb25778e9fd9c6e5f2622e6bd7a05dfd721aef908bcc4b16ccda1a74d23
BumbleBee
5f79572d35507c591a773925b8786c6caea69b19ef164b305d71070caf976707
BumbleBee
65e4da53beeeef0e8b00ec86fda5e63b653005b3d2e22183053f2cc220532f03
BumbleBee
84a71f90d0557682833992e3388949775e979efea501a8402496828112d8b814
BumbleBee
c600dd34854aa5c6c97ed8c1c92d28034d661652b4d892d223b6805a4e864622
BumbleBee
error
BumbleBee
f5a34ea26f8dd2498d8a8b6d9b5a6d374f854e600e8c80622e0bd3e7a7d43136
BumbleBee
+ 77 additional samples on MalwareBazaar
Result
Malware family:
bumblebee
Create hunting rule
Score:
  10/10
Tags:
family:bumblebee botnet:err discovery loader persistence privilege_escalation
Link:
https://tria.ge/reports/250416-2vjs1awycw/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Loads dropped DLL
Enumerates connected drives
Blocklisted process makes network request
BumbleBee
Bumblebee family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e710c065-5562-4c05-9de7-a3c6f81100d1
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/65e4da53beeeef0e8b00ec86fda5e63b653005b3d2e22183053f2cc220532f03

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/2542/

Comments