MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8695f4936f2942d322e2936106f78144f91602c7acace080e48c97e97b888377. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BumbleBee


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8695f4936f2942d322e2936106f78144f91602c7acace080e48c97e97b888377
SHA3-384 hash: 22e28ca70e156960fe43763e4350c90867ad67c925191459d8f76f109781f30bc2a60a45d9a61dfb77cdb76219add427
SHA1 hash: a8dec9dbb8a6e5d4959936c279137b777f4b81e5
MD5 hash: a32c35dbcfc0e85a80b6b69f40921027
humanhash: oklahoma-apart-florida-bakerloo
File name:SPECS_10.iso
Download: download sample
Signature BumbleBee
Create hunting rule
File size:1'366'016 bytes
First seen:2022-05-25 10:20:56 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:W6PfAzxcsJHLqkGlCG4loMOkNcNMVkc4mj3Z9ujl6:Ng99JHLqkGlCG4loMOnMS3OJIjl6
TLSH T1CD553B2E48AE4B4DE800CE7415343D33DAFBABD75A549298F6757887CE3E7A900B9740
TrID 99.6% (.NULL) null bytes (2048000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter plebourhis
Tags:BUMBLEBEE iso

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/628e034deba388bb86827ebd/reports/50c7deb1-4ba6-48fc-87a3-485941271df0/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8695f4936f2942d322e2936106f78144f91602c7acace080e48c97e97b888377/
Threat name:
Shortcut.Dropper.BumbleBee
Create hunting rule
Status:
Malicious
First seen:
2022-05-22 06:25:13 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
18 of 41 (43.90%)
Threat level:
  3/5
Result
Malware family:
bumblebee
Create hunting rule
Score:
  10/10
Tags:
family:bumblebee botnet:1605a evasion trojan
Link:
https://tria.ge/reports/220525-mdm2rsdfhj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks BIOS information in registry
Checks computer location settings
Identifies Wine through registry keys
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
BumbleBee
Malware Config
C2 Extraction:
209.141.37.189:443
194.135.33.137:443
49.12.241.35:443
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8695f4936f2942d322e2936106f78144f91602c7acace080e48c97e97b888377

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win64_bumbleebee_loader_packed
Create hunting rule
Author:Rony (@r0ny_123)
Rule name:Detect_BazarISO
Create hunting rule
Author:@johnk3r
Description:Detects BazarISO

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments