MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ce84fae3e55520c041d70bdb90900060eff61c6f9c4282cb48a899e15db0f50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BumbleBee

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	8ce84fae3e55520c041d70bdb90900060eff61c6f9c4282cb48a899e15db0f50
SHA3-384 hash:	0ba76996769d654397a67b94b7469946dbb9f6387a5d84f1573eac8f825a47d201c0d1683e210abc0b8cf58625250c3c
SHA1 hash:	a5b949649aeed6fb6c00ba9b96675f959635dcf6
MD5 hash:	b93dc51a8e8fd9a2823568d16e647050
humanhash:	pizza-illinois-kansas-red
File name:	Request-08-22-77.vhd
Download:	download sample
Signature	BumbleBee Create hunting rule
File size:	6'311'936 bytes
First seen:	2022-08-31 17:33:15 UTC
Last seen:	Never
File type:
MIME type:	application/x-virtualbox-vhd
ssdeep	98304:xvxtD66xLrsxIpMKEngsfyJllGVeTQKP7:xvxcWcxIpM/nTfEl8Vef
TLSH	T1FF56C0831CE88288DC2598F86FF1F173857F6A10CAF92A50A5217D6D59F5D23B23B718
Reporter	k3dg3___
Tags:	3108 BUMBLEBEE vhd

Intelligence

File Origin

# of uploads :

# of downloads :

192

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

TwinWave.EvilLNK.ReturnOfTheMac.002590d2c4a2.UNOFFICIAL

Verdict:

No Threat

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/630f9b61e87b88e71be8428f/reports/5d4f959f-f7ec-4b4b-978d-2cf20ea1c903/overview

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8ce84fae3e55520c041d70bdb90900060eff61c6f9c4282cb48a899e15db0f50/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rtue7lr6kvjayba5oc63sciaayhp6yog7hccqlfurkez4fo3b5ia._file

Result

Malware family:

bumblebee

Score:

10/10

Tags:

family:bumblebee botnet:3108 evasion trojan

Link:

https://tria.ge/reports/220831-wcavgsbdb9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of NtCreateThreadExHideFromDebugger

Checks BIOS information in registry

Identifies Wine through registry keys

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

BumbleBee

Malware Config

C2 Extraction:

54.203.130.81:428
103.160.22.125:439
100.194.5.156:279
138.10.128.167:465
16.68.199.17:119
49.58.238.45:318
158.121.21.147:265
76.179.109.138:320
219.114.206.84:318
242.123.229.45:306
247.142.48.124:278
137.128.84.3:389
178.18.89.43:472
68.72.230.54:206
253.1.172.156:320
88.12.127.219:297
113.50.222.178:284
135.21.140.60:404
64.44.102.36:443
247.232.101.39:263
25.164.199.235:483
229.34.16.142:331
161.192.84.102:421
92.50.58.134:268
150.69.136.89:264
117.250.45.148:196
193.19.186.178:227
80.161.122.170:210
51.83.249.204:443
244.56.215.21:367
146.70.106.163:443
22.226.202.236:160
5.98.161.45:407
169.173.118.1:482
241.97.45.244:361
25.22.207.178:454
33.152.14.249:176
225.69.64.137:234
66.123.133.120:125
233.57.245.52:193
175.88.206.214:229
12.171.4.209:360
203.176.214.111:334
22.233.59.206:201
81.135.6.89:355
151.147.0.228:393
129.92.194.112:238
249.69.235.102:423
131.243.196.86:251
135.47.154.49:225
225.22.137.126:322
18.153.76.23:229
189.3.235.110:232

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

VHD Ransomware

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8ce84fae3e55520c041d70bdb90900060eff61c6f9c4282cb48a899e15db0f50

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.