MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0fdc0b64b747f348a87a382ff5dfe016107f95ab5953318cc8d9548a983efd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BumbleBee


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0fdc0b64b747f348a87a382ff5dfe016107f95ab5953318cc8d9548a983efd1
SHA3-384 hash: 52d511b95f39b44d9dbd84991a9542d75c2357c5ee6a4182a5f6e426aebe2f98df436762c99c99103d99e784d6980121
SHA1 hash: 0c82220151415e6cbce25d2615d29f4352e0ecd5
MD5 hash: d7bb608a3b370fa7f457b4e89bbdb594
humanhash: avocado-kilo-solar-mexico
File name:upload.dll
Download: download sample
Signature BumbleBee
Create hunting rule
File size:2'083'840 bytes
First seen:2022-07-07 17:29:18 UTC
Last seen:2022-07-07 18:47:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9289cffe7de516dc979bba3057d301c4 (1 x BumbleBee)
ssdeep 49152:E5d89xB7DbdCFudCUJHYf+CkQFqs9Q0TzIThyXajgGdmV/GNtMsJ6HUdBGCLTte9:pDB7DbdCFudCUJHYf+CkQFqs9Q0TzIT2
Threatray 2'281 similar samples on MalwareBazaar
TLSH T1B3A5B962CB0AF80BDC2C6E7C807F0A4E1194EA081D23B59E1F5A7D5EDA7F643526E1C5
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter Rony
Tags:707a BUMBLEBEE exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
296
Origin country :
n/a
Vendor Threat Intelligence
Detection:
BumbleBee
Create hunting rule
Link:
https://www.capesandbox.com/analysis/285626/
Detection(s):
SecuriteInfo.com.UDS.Trojan-Dropper.Win64.BumbleBee.423.1122.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Detecting VM
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/24390/overview
Behaviour
MalwareBazaar
MeasuringTime
CPUID_Instruction
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/62c7182076fa5a59944b5db8/reports/f286d394-442c-4e58-9525-6785811280e9/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/09569e3c-95f4-49b9-8280-f8cc929fddc4
Result
Threat name:
BumbleBee
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1026671
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Searches for specific processes (likely to inject)
Sets debug register (to hijack the execution of another thread)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected BumbleBee
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 659168 Sample: upload.dll Startdate: 07/07/2022 Architecture: WINDOWS Score: 92 34 Antivirus detection for URL or domain 2->34 36 Yara detected BumbleBee 2->36 38 C2 URLs / IPs found in malware configuration 2->38 40 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->40 8 loaddll64.exe 1 2->8         started        process3 signatures4 48 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 8->48 50 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 8->50 52 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 8->52 54 4 other signatures 8->54 11 regsvr32.exe 8->11         started        14 cmd.exe 1 8->14         started        16 rundll32.exe 8->16         started        18 2 other processes 8->18 process5 signatures6 56 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 11->56 58 Contain functionality to detect virtual machines 11->58 60 Searches for specific processes (likely to inject) 11->60 20 rundll32.exe 14->20         started        62 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->62 23 WerFault.exe 9 18->23         started        25 WerFault.exe 3 9 18->25         started        27 WerFault.exe 18->27         started        process7 signatures8 42 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 20->42 44 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 20->44 46 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 20->46 29 WerFault.exe 17 9 20->29         started        process9 dnsIp10 32 192.168.2.1 unknown unknown 29->32
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0fdc0b64b747f348a87a382ff5dfe016107f95ab5953318cc8d9548a983efd1/
Threat name:
Win64.Dropper.BumbleBee
Create hunting rule
Status:
Malicious
First seen:
2022-07-07 17:30:09 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
15 of 26 (57.69%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6d64bnslor7tjcuhuobp6xp6afqqp6k2wwktgggmrwkurkmd57iq._file
Verdict:
malicious
Similar samples:
287055194e83ab2a8d91ef4d187de57345c19018cf3a85024c4fd20c64ad689e
BumbleBee
47fa907c50a09bc2fc41cf50afac4e178f7ce51c9592f18335db53976e87e92e
BumbleBee
78c5d780b2ca553cbd3fb0140813e0e1fb7c48491090df605f03c309d0086baf
BumbleBee
a27dfea07887442cd18f7f52d3f28994e9b93631a998fe254a8bc654fad94b4e
BumbleBee
ccde5e528a8da994b3cd96a988023acd16a78a9cea4fe5dc1b41d9a72890a995
BumbleBee
e9b974d8bef3bbad04eb70f84f2102ca39faee208aea618fac76730f7d5d75bf
BumbleBee
ea52c881008e458daee5570c03b89726a0b3a652c26a3ec63002c82ba461e48c
BumbleBee
+ 2'271 additional samples on MalwareBazaar
Result
Malware family:
bumblebee
Create hunting rule
Score:
  10/10
Tags:
family:bumblebee botnet:707a evasion trojan
Link:
https://tria.ge/reports/220707-v25wgscghk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtCreateThreadExHideFromDebugger
Checks BIOS information in registry
Identifies Wine through registry keys
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
BumbleBee
Malware Config
C2 Extraction:
172.240.175.194:183
171.85.135.192:358
223.7.203.157:407
45.153.242.183:443
211.68.220.197:102
174.119.130.65:369
202.41.22.30:314
58.10.113.168:308
12.33.69.160:285
205.185.123.137:443
112.188.178.13:332
168.205.228.104:480
83.218.135.147:151
228.175.209.140:269
240.114.36.128:411
8.109.227.172:304
142.11.245.185:443
214.233.117.120:167
198.135.200.7:254
73.74.56.146:272
14.42.55.81:416
15.237.42.8:408
159.192.221.167:410
197.26.182.136:279
41.140.44.116:454
161.144.98.94:427
46.208.205.43:235
37.231.14.207:370
183.236.246.8:410
41.232.231.227:382
47.225.45.93:285
162.191.88.20:114
114.170.141.82:227
90.86.27.214:238
117.176.252.35:344
247.184.192.227:394
95.26.242.141:126
75.146.161.164:331
15.14.147.134:401
50.69.254.239:246
69.181.36.251:119
53.34.28.231:447
44.245.217.17:369
237.57.151.39:372
103.175.16.105:443
67.35.182.6:434
146.19.173.31:443
20.189.66.15:257
105.221.27.232:344
88.82.146.11:254
204.63.253.164:476
191.159.75.135:494
214.207.26.205:301
16.182.11.140:166
45.135.162.238:267
Unpacked files
SH256 hash:
f0fdc0b64b747f348a87a382ff5dfe016107f95ab5953318cc8d9548a983efd1
MD5 hash:
d7bb608a3b370fa7f457b4e89bbdb594
SHA1 hash:
0c82220151415e6cbce25d2615d29f4352e0ecd5
Link:
https://www.unpac.me/results/75e91635-a33b-4474-91fa-10c0efab058c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f0fdc0b64b74/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f0fdc0b64b747f348a87a382ff5dfe016107f95ab5953318cc8d9548a983efd1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win64_bumbleebee_loader_packed
Create hunting rule
Author:Rony (@r0ny_123)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/285626/

Comments