March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – KONNI APT Group – Active IOCs
June 22, 2022
Rewterz Threat Alert – Dridex Banking Trojan – Active IOCs
June 22, 2022
Rewterz Threat Alert – KONNI APT Group – Active IOCs
June 22, 2022
Rewterz Threat Alert – Dridex Banking Trojan – Active IOCs
June 22, 2022
Severity
Medium
Analysis Summary
The malware loader, Bumblebee, is used to download Cobalt Strike and perhaps other malware such as ransomware. It also replaces the BazarLoader backdoor, which is previously used to transmit ransomware payloads. According to researchers, the appearance of Bumblebee in phishing attempts in March correlates with a drop in the use of BazarLoader for distributing file-encrypting malware.
Bumblebee is distributed in the form of ISO files that contain malicious DLL and shortcut files. It employs different techniques to avoid detection. It can determine virtualization environment processes to prevent operating on virtual machines. Banking information, password, and identity theft are the main impact of this malware.
Bumblebee malware is designed to download and run additional payloads in order to infect computers with other malware. Bumblebee can be used to inject information stealers, cryptocurrency miners, and other malware since it is designed to drop extra payloads. The C2 (Command and Control) server is where Bumblebee gets commands. It is used by the attackers to download and execute files directly, inject malicious DLLs, and create operating system persistence.
This malware is distributed via phishing emails in the form of an ISO file, which contains a shortcut and a malicious DLL file. According to researchers Bumblebee was recently distributed to Korean users via email hijacking in certain situations.
Impact
- Credential Theft
- Financial Loss
- Exposure of Sensitive Data
Indicators of Compromise
MD5
- ecea8acb3ab781ce41acc5487a8108e9
- e34a3b110c870fbdb80849adbd5a1577
- b334f974b6181a605b2940af8a052b9f
SHA-256
- 24aa82e1a085412686af5d178810fc0d056c5b8167ae5b88973b33071aa14569
- 88c07354f1d7b0485452d5c39dc1a6d73884e163bc5489c40adc6662602b4d76
- ade875616534b755f33f6012ea263da808dd7eb50bc903fc97722f37fac7c164
SHA-1
- 3c3e1f8140c37a88af0fe37ff8572e3d2151b299
- 7a285c8fe51720e3685e7659520b0598eae30b88
- 2bd38f2060bf9a759ddcc81a6772fb6bc149d1d0
Remediation
- Block the threat indicators at their respective controls.
- Search for IOCs in your environment.