BumbleBee Loader -- 1.8MB EXE, GlobalSign TLS, Sifrelenmis C2 Config, Cobalt Strike Yukleme | Kritik

Manuel Statik Analiz — BumbleBee Loader | Tehdit: KRITIK

Fichier Kimligi

SHA256	`670781d0d35582d3094cf375a43c59cfba157e0a99fe919e462ad06045f0843c`
Taille	1.852.656 byte (1.8MB)
String Sayisi	7.909

C2 Konfigurasyonu (Sifrelenmis)

wC2%]     -- Sifrelenmis C2 config fragmenti
FC2ER     -- C2 referansi
ZC2;a     -- C2 sekman isaretcisi
j4 =c2Z   -- C2 config bayti

TLS Sertifikasi

http://crl.globalsign.com/ca/gstsacasha384g4.crl
-- GlobalSign SHA384 CA sertifikasi
-- BumbleBee HTTPS C2 trafinini mesgru TLS ile gizler

BumbleBee Hakkinda

BumbleBee, 2022 yilinda C++ ile yazilmis loader ailesidir. Google Ads ve phishing ile dagitilir. Cobalt Strike, Meterpreter, Sliver yukler. AES sifrelenmis HTTPS C2 kullanir.

IOC

SHA256	`670781d0d35582d3094cf375a43c59cfba157e0a99fe919e462ad06045f0843c`
C2 Protokol	HTTPS + TLS (GlobalSign)

BumbleBee — Profil du malware

Bumblebee, 2022 den aktif C++ loader. Conti/Lazarus bağlantılı. ISO/VHD/LNK dağıtım. Cobalt Strike dropper. Anti-debug.

Type de malware

Loader

Langage de programmation

C++

Protocole C2

HTTPS

Systèmes ciblés

Windows

Détails techniques

Loader ailesi: HTTP/HTTPS C2, payload sifre cozme ve bellek icerisinde yükleme, anti-sandbox/VM kontrolleri, process injection, persistence mekanizmasi, yükü indirme ve calistirma zinciri

Capacités et comportement

Payload İndirme

Süreç Enjeksiyonu

Modüler Mimari

Kimlik Bilgisi Hırsızlığı

Yanal Hareket

Kalıcılık

Anti-VM/Sandbox

İkincil Payload Dağıtımı

Liste IOC (1 indicateurs)

IOC — BumbleBee

# SHA256
670781d0d35582d3094cf375a43c59cfba157e0a99fe919e462ad06045f0843c

Type	Valeur	Note
sha256	670781d0d35582d3094cf375a43c59cfba157e0a99fe919e462ad06045f0843c

BumbleBee — Voir le profil complet →

Serveurs C2 (3 serveurs enregistrés pour cette famille)

Adresse	Type	Port	Protocole	Statut	Pays
odoca.com	domain	443	HTTPS	active	—
108.61.55.248	ip	443	HTTPS	inactive	US
45.8.146.78	ip	443	HTTPS	inactive	RU

Les adresses C2 proviennent uniquement d'échantillons de malwares vérifiés manuellement par l'équipe KEYDAL. Toute utilisation commerciale est interdite.