March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Hive Ransomware Received Approximately US$100 Million In Ransom Payments – Active IOCs
November 29, 2022
Rewterz Threat Advisory – CVE-2022-41732 – IBM Maximo Vulnerability
November 30, 2022
Rewterz Threat Alert – Hive Ransomware Received Approximately US$100 Million In Ransom Payments – Active IOCs
November 29, 2022
Rewterz Threat Advisory – CVE-2022-41732 – IBM Maximo Vulnerability
November 30, 2022
Severity
Medium
Analysis Summary
The malware loader, Bumblebee, is used to download Cobalt Strike and perhaps other malware such as ransomware. It also replaces the BazarLoader backdoor, which is previously used to transmit ransomware payloads. This new malware is linked to a number of threat actors, including several well-known ransomware.
According to researchers, the appearance of Bumblebee in phishing attempts in March correlates with a drop in the use of BazarLoader for distributing file-encrypting malware.
Bumblebee is distributed in the form of ISO files that contain malicious DLL and shortcut files. It employs different techniques to avoid detection. It can determine virtualization environment processes to prevent operating on virtual machines. Banking information, password, and identity theft are the main impact of this malware.
Bumblebee malware is designed to download and run additional payloads in order to infect computers with other malware. Bumblebee can be used to inject information stealers, cryptocurrency miners, and other malware since it is designed to drop extra payloads. The C2 (Command and Control) server is where Bumblebee gets commands. It is used by attackers to download and execute files directly, inject malicious DLLs, and create operating system persistence. This new malware is linked to a number of threat actors, including several well-known ransomware.
Impact
- Credential Theft
- Financial Loss
- Sensitive Data Exposure
Indicators of Compromise
MD5
0502619a8ec457ec91f82748c2e6d1ec
f8a6948b927d6a0408679fc623994571
SHA-256
4359aa457c9788ca56db263a20e8ad9f65c055cbd84942c8e834f604295402dd
95a37ee707f673e561f3a8dbb27927f7140b8541c12eb805bf47613adc36b584
SHA-1
90be2b5ee9c1dc27d28a2d5cae5d15db25f52ce4
2246524678f02ca6e76d861f29a6a3642309fafe
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.