Rewterz Threat Alert – AZORult Malware – Active IOCs
November 15, 2022Rewterz Threat Alert – LokiBot Malware – Active IOCs
November 15, 2022Rewterz Threat Alert – AZORult Malware – Active IOCs
November 15, 2022Rewterz Threat Alert – LokiBot Malware – Active IOCs
November 15, 2022Severity
Medium
Analysis Summary
The malware loader, Bumblebee, is used to download Cobalt Strike and perhaps other malware such as ransomware. It also replaces the BazarLoader backdoor, which is previously used to transmit ransomware payloads. This new malware is linked to a number of threat actors, including several well-known ransomware.
According to researchers, the appearance of Bumblebee in phishing attempts in March correlates with a drop in the use of BazarLoader for distributing file-encrypting malware.
Bumblebee is distributed in the form of ISO files that contain malicious DLL and shortcut files. It employs different techniques to avoid detection. It can determine virtualization environment processes to prevent operating on virtual machines. Banking information, password, and identity theft are the main impact of this malware.
Bumblebee malware is designed to download and run additional payloads in order to infect computers with other malware. Bumblebee can be used to inject information stealers, cryptocurrency miners, and other malware since it is designed to drop extra payloads. The C2 (Command and Control) server is where Bumblebee gets commands. It is used by the attackers to download and execute files directly, inject malicious DLLs, and create operating system persistence.This new malware is linked to a number of threat actors, including several well-known ransomware.
Impact
- Credential Theft
- Financial Loss
- Exposure of Sensitive Data
Indicators of Compromise
IP
- 45.153.243.93
MD5
ee7ad5fe821fb9081380dbbf40c4f062
1233a723ebdece80cb592aa584510066
SHA-256
3c600328e1085dc73d672d068f3056e79e66bec7020be6ae907dd541201cd167
0b98bff25ebce8053e2c39214b3622b8d8666ae416afb52c5842312f27a6914f
SHA-1
38eef0cdaa8faa27c9e2cedeafcfe842e2e0e08e
d52fe73050ba2b765dde5038db762b183641aee8
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.