• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Agent Tesla Malware – Active IOCs
June 21, 2022
Rewterz Threat Advisory – CVE-2022-1642 – Apple swift-corelibs-foundation Vulnerability
June 22, 2022

Rewterz Threat Alert – BumbleBee Malware – Active IOCs

June 21, 2022

Severity

Medium

Analysis Summary

The malware loader, Bumblebee, is used to download Cobalt Strike and perhaps other malware such as ransomware. It also replaces the BazarLoader backdoor, which is previously used to transmit ransomware payloads. According to researchers, the appearance of Bumblebee in phishing attempts in March correlates with a drop in the use of BazarLoader for distributing file-encrypting malware.
Bumblebee is distributed in the form of ISO files that contain malicious DLL and shortcut files. It employs different techniques to avoid detection. It can determine virtualization environment processes to prevent operating on virtual machines. Banking information, password, and identity theft are the main impact of this malware. 
Bumblebee malware is designed to download and run additional payloads in order to infect computers with other malware. Bumblebee can be used to inject information stealers, cryptocurrency miners, and other malware since it is designed to drop extra payloads. The C2 (Command and Control) server is where Bumblebee gets commands. It is used by the attackers to download and execute files directly, inject malicious DLLs, and create operating system persistence.

This malware is distributed via phishing emails in the form of an ISO file, which contains a shortcut and a malicious DLL file. According to researchers Bumblebee was recently distributed to Korean users via email hijacking in certain situations.

image-24.png?resize=1024%2C603&ssl=1

Impact

  • Credential Theft
  • Financial Loss
  • Exposure of Sensitive Data

Indicators of Compromise

IP

  • 73[.]214[.]29[.]52
  • 78[.]112[.]52[.]91
  • 21[.]175[.]22[.]99
  • 107[.]90[.]225[.]1
  • 212[.]114[.]52[.]46
  • 101[.]88[.]16[.]100
  • 19[.]71[.]13[.]153
  • 108[.]16[.]90[.]159
  • 103[.]175[.]16[.]122

MD5

  • b7936d2eed4af4758d2c5eac760baf1d
  • e50fff61c27e6144823dd872bf8f8762
  • 2c9a4291387fd1472081c9c464a8a470

SHA-256

  • 97a67695c26da439e86856ea6722976a0d56831ddc5b15b211ed8a76b03fb058
  • 43bb841adb0b67311d5da7a44036dccfe48f2b7475ee8685fe71ab83a23729bc
  • f32b9d77102fb36b32492f6edf44d9489acd7f6f07d38af03deb31f344c8700d

SHA-1

  • b4f450130b807735feadeefbe0f01d1493b1062d
  • 2cbc880be5d55dc58d1056b0a395cbe51b561582
  • 4e0b948c8d4f22048b49d3308c0f27bfc64f390d

Remediation

  • Block the threat indicators at their respective controls.
  • Search for IOCs in your environment.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.