MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78c5d780b2ca553cbd3fb0140813e0e1fb7c48491090df605f03c309d0086baf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BumbleBee


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78c5d780b2ca553cbd3fb0140813e0e1fb7c48491090df605f03c309d0086baf
SHA3-384 hash: 51d04394e2178c5b8cd8230720f77230e17fc699bd149e6f9aa35cefdbf8eb706477246cc25b1c5d5a586f67de9cf41f
SHA1 hash: 668e08011689b809bc231a6bc31ddd6ea576942d
MD5 hash: fab844f64a60f24b27097d3b7b93cc11
humanhash: xray-eighteen-river-mike
File name:toso3l.dll
Download: download sample
Signature BumbleBee
Create hunting rule
File size:1'777'152 bytes
First seen:2022-06-25 20:05:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0961e57709158541d151ca3f45b82efb (1 x BumbleBee)
ssdeep 24576:Qtf9NAUsrCADj6jns63ntdskTAEwL+/j/QnFR/ZVWd+G2l9b55oF74zU:Qt1NNsrHDMf2FxbDfl9b55oFE
Threatray 2'261 similar samples on MalwareBazaar
TLSH T13A855C60C1648389FE1D7B38A43D0A2F47BF2F9D2568930D9565F0FA3FAA783D528590
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter Uxtal
Tags:BUMBLEBEE exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
357
Origin country :
n/a
Vendor Threat Intelligence
Detection:
BumbleBee
Create hunting rule
Link:
https://www.capesandbox.com/analysis/283276/
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/62b76aab1e58e55866068717/reports/13ac0cb5-dc17-4e96-8b30-5a085f3b2d13/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/18b63ec3-a35b-451a-804f-0824519ae3bb
Result
Threat name:
BumbleBee
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1019817
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Searches for specific processes (likely to inject)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected BumbleBee
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78c5d780b2ca553cbd3fb0140813e0e1fb7c48491090df605f03c309d0086baf/
Threat name:
Win64.Trojan.Bumbleloader
Create hunting rule
Status:
Malicious
First seen:
2022-06-25 20:06:11 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pdc5pafszjktzpj7wakaqe7a4h5xyscjccin6yc7apbqtuainoxq._file
Verdict:
malicious
Similar samples:
47fa907c50a09bc2fc41cf50afac4e178f7ce51c9592f18335db53976e87e92e
BumbleBee
538d9548d4b197611a07d436feb27beff04e6cd53fba88b1cfdee626eff89db2
BumbleBee
a27dfea07887442cd18f7f52d3f28994e9b93631a998fe254a8bc654fad94b4e
BumbleBee
ccde5e528a8da994b3cd96a988023acd16a78a9cea4fe5dc1b41d9a72890a995
BumbleBee
e9b974d8bef3bbad04eb70f84f2102ca39faee208aea618fac76730f7d5d75bf
BumbleBee
ea52c881008e458daee5570c03b89726a0b3a652c26a3ec63002c82ba461e48c
BumbleBee
+ 2'251 additional samples on MalwareBazaar
Result
Malware family:
bumblebee
Create hunting rule
Score:
  10/10
Tags:
family:bumblebee botnet:1406r evasion trojan
Link:
https://tria.ge/reports/220625-yvdefacdb3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Checks BIOS information in registry
Identifies Wine through registry keys
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
BumbleBee
Malware Config
C2 Extraction:
39.57.152.217:440
69.161.201.181:382
244.6.154.71:111
193.233.203.156:443
221.106.84.123:307
194.135.33.148:443
111.99.39.11:387
223.243.46.133:147
48.165.175.199:316
78.89.31.86:229
157.17.142.85:406
90.81.8.16:370
21.29.238.98:209
154.56.0.252:443
103.175.16.108:443
188.57.4.52:357
15.209.19.148:466
160.70.24.228:486
33.145.184.132:240
235.126.132.170:106
171.78.101.85:258
188.6.218.149:317
123.67.113.210:483
115.109.212.139:461
167.28.27.185:467
185.62.58.133:443
133.57.116.243:424
47.58.200.234:159
142.182.181.207:450
57.240.143.90:256
158.35.83.74:332
135.253.243.175:300
34.229.154.31:235
104.168.219.94:443
48.209.106.172:357
68.227.158.172:411
80.9.246.19:338
45.153.241.187:443
145.239.135.155:443
188.104.94.69:348
246.20.199.100:175
80.26.101.48:372
22.83.186.45:201
146.70.125.82:443
216.254.58.191:443
80.156.1.202:305
107.44.53.47:330
67.136.243.43:323
172.244.110.160:367
Unpacked files
SH256 hash:
78c5d780b2ca553cbd3fb0140813e0e1fb7c48491090df605f03c309d0086baf
MD5 hash:
fab844f64a60f24b27097d3b7b93cc11
SHA1 hash:
668e08011689b809bc231a6bc31ddd6ea576942d
Link:
https://www.unpac.me/results/3fdcc589-2c92-4151-8ab7-5e631aac363c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/78c5d780b2ca/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/78c5d780b2ca553cbd3fb0140813e0e1fb7c48491090df605f03c309d0086baf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win64_bumbleebee_loader_packed
Create hunting rule
Author:Rony (@r0ny_123)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BumbleBee

Executable exe 78c5d780b2ca553cbd3fb0140813e0e1fb7c48491090df605f03c309d0086baf

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/283276/

Comments