MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9a1ce3417838013412f81425ef74a37608754586722e00cacb333ba88eb9aa7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BumbleBee

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	e9a1ce3417838013412f81425ef74a37608754586722e00cacb333ba88eb9aa7
SHA3-384 hash:	8ef4d9dce1fd38b9532b9657f2f75a55c9e77074748d407634dbf1f092e3a8757ebdc413da7049e198855481d2c6bd74
SHA1 hash:	e0f6d121580e6e52499f7b90b33644b79578fb32
MD5 hash:	a107688e5cc0c9332f47eadbdb682f69
humanhash:	quebec-lima-fanta-six
File name:	Presentation for REMOVED.vhd
Download:	download sample
Signature	BumbleBee Create hunting rule
File size:	6'311'936 bytes
First seen:	2022-09-07 19:44:25 UTC
Last seen:	2023-03-08 15:16:04 UTC
File type:
MIME type:	application/x-virtualbox-vhd
ssdeep	24576:nCrxYbz4x5sfmFGtW4FnXVROmygccvaP0iP:HrUGtbXDOnB8
TLSH	T13356FA342EEA502AF173EF7D8AE4759AD95FBBA33703585D10A1038A0B23942EDD153D
Reporter	k3dg3___
Tags:	BUMBLEBEE TA580 vhd

Intelligence

File Origin

# of uploads :

# of downloads :

286

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

TwinWave.EvilLNK.ReturnOfTheMac.002590d2c4a2.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

odbcconf.exe

Link:

https://www.filescan.io/uploads/6318f501d94ccae410836dd8/reports/57bc7675-2476-41b5-9bd7-cbee7dc2a048/overview

Result

Verdict:

UNKNOWN

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e9a1ce3417838013412f81425ef74a37608754586722e00cacb333ba88eb9aa7/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5gq44naxqoabgqjpqfbf552kg5qiovcym4roadfmwmz3vchltktq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/e9a1ce3417838013412f81425ef74a37608754586722e00cacb333ba88eb9aa7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_win64_bumblebee_powershell_loader Create hunting rule
Author:	Rony
Description:	Detects a Powershell Loader used to load bumblebee in memory