Rewterz Threat Alert – Bumblebee Malware Evolving Its TTPs – Active IOCs

Severity

Medium

Analysis Summary

The malware loader, Bumblebee, is used to download Cobalt Strike and perhaps other malware such as ransomware. It also replaces the BazarLoader backdoor, which is previously used to transmit ransomware payloads. This new malware is linked to a number of threat actors, including several well-known ransomware.

According to researchers, the appearance of Bumblebee in phishing attempts in March correlates with a drop in the use of BazarLoader for distributing file-encrypting malware.
Bumblebee is distributed in the form of ISO files that contain malicious DLL and shortcut files. It employs different techniques to avoid detection. It can determine virtualization environment processes to prevent operating on virtual machines. Banking information, password, and identity theft are the main impact of this malware. 
Bumblebee malware is designed to download and run additional payloads in order to infect computers with other malware. Bumblebee can be used to inject information stealers, cryptocurrency miners, and other malware since it is designed to drop extra payloads. The C2 (Command and Control) server is where Bumblebee gets commands. It is used by the attackers to download and execute files directly, inject malicious DLLs, and create operating system persistence. This new malware is linked to a number of threat actors, including several well-known ransomware.

Bumblebee malware continues to evolve as its loader mechanism underwent a major transformation twice in the span of a few days, switching from using ISO format files to VHD format files containing a powershell script, then back. This is the finest example of how Bumblebee is always evolving.

According to researchers,

Similar to other sophisticated malware families like Trickbot, Bumblebee employs its own packer for both the threat itself and some of the samples it distributes on victims’ PCs, unlike other attacks that use third-party packers and off-the-shelf antivirus evasion tools.

In addition to giving Bumblebee operators more freedom to modify behaviour and add features, this also makes it possible to spot Bumblebee activity in the wild rapidly by using special custom tools.

source: Different Bumblebee samples drop identical payloads.

Impact

• Credential Theft
• Financial Loss
• Exposure of Sensitive Data

Indicators of Compromise

IP

• 104[.]168[.]201[.]219
• 145[.]239[.]135[.]155
• 146[.]70[.]125[.]122
• 185[.]62[.]58[.]175
• 209[.]141[.]46[.]50
• 51[.]68[.]144[.]94
• 51[.]68[.]147[.]233
• 51[.]83[.]251[.]245
• 54[.]37[.]130[.]166
• 54[.]38[.]136[.]187

MD5

• 8be879ab5a99a433dcd6982d6dc7fff0
• fc75abb3d1395c54ba8e41aba1b90346
• 6b57fa501321b2ac4f67643f3efc389f
• 87bc17ea62e180a67d9d27de3297f79a
• 2701f52bcd200c42b67eca4aea64d62e
• f035940b5e20a2ecda4f7ea5c682aa84

SHA-256

• c70413851599bbcd9df3ce34cc356b66d10a5cbb2da97b488c1b68894c60ea69
• 14f04302df7fa49d138c876705303d6991083fd84c59e8a618d6933d50905c61
• 76e4742d9e7f4fd3a74a98c006dfdce23c2f9434e48809d62772acff169c3549
• 024f8b16ee749c7bb0d76500ab22aa1418cd8256fb12dcbf18ab248acf45947e
• 2691858396d4993749fec76ac34cf3cc3658ee3d4eaf9c748e2782cfc994849d
• 6bc2ab410376c1587717b2293f2f3ce47cb341f4c527a729da28ce00adaaa8db

SHA-1

• 0cd574a221ce94e2538375ac645f1429ac3b92a0
• 89cc35d6c587eaa1b852022dc5f589246fb92a7b
• a4654130534ad4644da52f758b35de784c01913d
• 103f40cf2a52b14f5b87c2ae5631f4d6dde057de
• e4e4b80fed0751fce8864158ff7c833a5cc2ea49
• 8ed8ef1727c3feb5bd2228db8f13fd0898d2e2b2

Remediation

• Block the threat indicators at their respective controls.
• Search for IOCs in your environment.