MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddb9895f9e74d3e7db4e94aa77338fdc221ed29f29857a9752545cddcf8f45a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BumbleBee


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddb9895f9e74d3e7db4e94aa77338fdc221ed29f29857a9752545cddcf8f45a6
SHA3-384 hash: 415cfd842f9769828f6b0aaac1b0f6463d7af9a972b6c9aa1a7fb63edafe59fa6b960f2edeede34f0b0dc52a4abacd3c
SHA1 hash: ef7687fd12df2a102e443a9cfa6c09a1f16b0035
MD5 hash: 1e97fac877fd16aa937bdc35714cc058
humanhash: juliet-romeo-december-ceiling
File name:grasbly.dll
Download: download sample
Signature BumbleBee
Create hunting rule
File size:3'796'992 bytes
First seen:2022-10-21 22:36:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 25b614d05800ad54d250ce40fff8727c (1 x BumbleBee)
ssdeep 24576:E3RgLkXy4o8Bhf1d9I25Xroti/mb8RqrU9dveOgTRXfXAffHjonc64PZmwfzbpSc:EBgLOM8bfVI25lm6n9klBfGt6AZbZSq
Threatray 2'445 similar samples on MalwareBazaar
TLSH T143064C838A11DFBBCA5D84FF89BF160D43121377A9633D2B382ABC8415637016697B5E
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter pr0xylife
Tags:2010m BUMBLEBEE exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
318
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
grasbly.dll
Verdict:
No threats detected
Analysis date:
2022-10-21 22:39:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3487899b-c9c0-4ba7-801d-c86ccb164b8b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
BumbleBee
Create hunting rule
Link:
https://www.capesandbox.com/analysis/322426/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Detecting VM
Using the Windows Management Instrumentation requests
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63531ed6b5f60e72b8c7c5eb/reports/2bce6586-2339-474e-a588-0aa36dea2a2f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/6e6952d2-2672-4fe5-a5ec-81395e62434b
Result
Threat name:
BumbleBee
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1095203
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Searches for specific processes (likely to inject)
Sets debug register (to hijack the execution of another thread)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected BumbleBee
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 727844 Sample: grasbly.dll.exe Startdate: 22/10/2022 Architecture: WINDOWS Score: 100 29 Malicious sample detected (through community Yara rule) 2->29 31 Antivirus / Scanner detection for submitted sample 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 3 other signatures 2->35 8 loaddll64.exe 1 2->8         started        process3 signatures4 43 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->43 45 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 8->45 47 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->47 49 4 other signatures 8->49 11 regsvr32.exe 8->11         started        14 cmd.exe 1 8->14         started        16 rundll32.exe 8->16         started        18 2 other processes 8->18 process5 signatures6 51 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->51 53 Contain functionality to detect virtual machines 11->53 55 Searches for specific processes (likely to inject) 11->55 20 rundll32.exe 14->20         started        57 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->57 23 WerFault.exe 3 9 18->23         started        process7 signatures8 37 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 20->37 39 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 20->39 41 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 20->41 25 WerFault.exe 17 9 20->25         started        27 WerFault.exe 20->27         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ddb9895f9e74d3e7db4e94aa77338fdc221ed29f29857a9752545cddcf8f45a6/
Threat name:
Win64.Dropper.BumbleBee
Create hunting rule
Status:
Malicious
First seen:
2022-10-21 19:45:08 UTC
File Type:
PE+ (Dll)
AV detection:
16 of 26 (61.54%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3w4ysx46otj6pw2ossvhom4p3qrb5uu7fgcxvf2skron3t4piwta._file
Verdict:
malicious
Similar samples:
32d3c8a61ba7a61d1f7466a4a60f7b52bb9bb0e6d000418da5cce79831f55a8c
BumbleBee
758a297cfdd9b02c9bb831f016db3dd27122c03027bbcfd4ecb489721e2107a7
BumbleBee
7e7ca9fef0083b88e55d517ada57c8a51018000e601d6043815558445277f913
BumbleBee
9938cd36c4ba702ce2b134f842c69b71cb56e11bb2dcbfd479074cda88403994
BumbleBee
a0ef27df11265b6574151454bd072b2854b26512fa7be152e3ddd316833408c9
BumbleBee
a254c70c34119f933bb2e0202fdaaf29e5a0874592df0adacf1ccf751a957441
BumbleBee
c78290da99475f965ce54f737e0927a9855e03c9a27f2ee7a797562533779305
BumbleBee
+ 2'435 additional samples on MalwareBazaar
Result
Malware family:
bumblebee
Create hunting rule
Score:
  10/10
Tags:
family:bumblebee botnet:2010m evasion trojan
Link:
https://tria.ge/reports/221021-2h9tnahefn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtCreateThreadExHideFromDebugger
Checks BIOS information in registry
Identifies Wine through registry keys
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
BumbleBee
Malware Config
C2 Extraction:
23.106.160.112:443
146.59.116.146:443
172.93.193.220:443
Gathering data
Unpacked files
SH256 hash:
ddb9895f9e74d3e7db4e94aa77338fdc221ed29f29857a9752545cddcf8f45a6
MD5 hash:
1e97fac877fd16aa937bdc35714cc058
SHA1 hash:
ef7687fd12df2a102e443a9cfa6c09a1f16b0035
Link:
https://www.unpac.me/results/1119d7f4-22fa-409c-b106-21c8cfe344e1/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ddb9895f9e74/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ddb9895f9e74d3e7db4e94aa77338fdc221ed29f29857a9752545cddcf8f45a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BumbleBeeLoader
Create hunting rule
Author:enzo & kevoreilly
Description:BumbleBee Loader
Rule name:bumblebee_win_generic
Create hunting rule
Author:_kphi
Rule name:crime_win64_bumbleebee_loader_packed
Create hunting rule
Author:Rony (@r0ny_123)
Description:Detects Bumblebee loader dll
Rule name:malware_bumblebee_packed
Create hunting rule
Author:Marc Salinas @ CheckPoint Research
Description:Detects the packer used by bumblebee, the rule is based on the code responsible for allocating memory for a critical structure in its logic.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/322426/

Comments