Rewterz Threat Alert – BumbleBee Malware – Active IOCs

Severity

Medium

Analysis Summary

The malware loader, Bumblebee, is used to download Cobalt Strike and perhaps other malware such as ransomware. It also replaces the BazarLoader backdoor, which is previously used to transmit ransomware payloads. According to researchers, the appearance of Bumblebee in phishing attempts in March correlates with a drop in the use of BazarLoader for distributing file-encrypting malware.
Bumblebee is distributed in the form of ISO files that contain malicious DLL and shortcut files. It employs different techniques to avoid detection. It can determine virtualization environment processes to prevent operating on virtual machines. Banking information, password, and identity theft are the main impact of this malware. 
Bumblebee malware is designed to download and run additional payloads in order to infect computers with other malware. Bumblebee can be used to inject information stealers, cryptocurrency miners, and other malware since it is designed to drop extra payloads. The C2 (Command and Control) server is where Bumblebee gets commands. It is used by the attackers to download and execute files directly, inject malicious DLLs, and create operating system persistence.

Impact

• Credential Theft
• Financial Loss
• Exposure of Sensitive Data

Indicators of Compromise

MD5

• 9eed94695a18301152a1fef1de8c07d1

SHA-256

• 5fa56c3c2cc2b06792ce65be87efd3930d66d8d80791ddc76204f841ac261f43

SHA-1

• f93a7a8bd08dc1e22179aee66a13ab0606e09e07

Remediation

• Block the threat indicators at their respective controls.
• Search for IOCs in your environment.