March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Confucius APT Threat Actors – Active IOCs
January 31, 2023
Rewterz Threat Advisory – ICS: Hitachi Storage Plug-in for VMware vCenter Vulnerabilities
February 1, 2023
Rewterz Threat Alert – Confucius APT Threat Actors – Active IOCs
January 31, 2023
Rewterz Threat Advisory – ICS: Hitachi Storage Plug-in for VMware vCenter Vulnerabilities
February 1, 2023
Severity
Medium
Analysis Summary
The malware loader, Bumblebee, is used to download Cobalt Strike and perhaps other malware such as ransomware. It also replaces the BazarLoader backdoor, which is previously used to transmit ransomware payloads. This new malware is linked to a number of threat actors, including several well-known ransomware.
According to researchers, the appearance of Bumblebee in phishing attempts in March correlates with a drop in the use of BazarLoader for distributing file-encrypting malware.
Bumblebee is distributed in the form of ISO files that contain malicious DLL and shortcut files. It employs different techniques to avoid detection. It can determine virtualization environment processes to prevent operating on virtual machines. Banking information, password, and identity theft are the main impact of this malware.
Bumblebee malware is designed to download and run additional payloads in order to infect computers with other malware. Bumblebee can be used to inject information stealers, cryptocurrency miners, and other malware since it is designed to drop extra payloads. The C2 (Command and Control) server is where Bumblebee gets commands. It is used by attackers to download and execute files directly, inject malicious DLLs, and create operating system persistence. This new malware is linked to a number of threat actors, including several well-known ransomware.
Impact
- Credential Theft
- Financial Loss
- Sensitive Data Exposure
Indicators of Compromise
MD5
- a6eb5da8a7d233b137c7214ad7704d80
- 8afc8b0d6a3f0690d319d0dec85e97da
- b955bf20f8c1b01b9f1d12023183115d
- e39789990eba9a36eb8631f4d799cb52
SHA-256
- 220643466b3b056319813f6a504726baf236e866d32dace4290bab262f8f455f
- d3195c8dbeb74fded26d4665226611acc1dc7306cfad6a478f3c3c93692307f3
- 84155dc50b0e963c16477793e5814b9feb9603b80924a047d7558a26228b6749
- 547294e9d1cd43c6d8582d62813c7aa26b81ef8affe7d16f3657a4ae202af1b1
SHA-1
- bdc3992db4b6f346eb42df7ae8991ba26c4b528a
- bc360c72abfa634f2d5c8c1e4cb4d8964a34a5fe
- 1649e261310a5cd12965bc7a6440c18adaeea6b9
- e02bd79098b812895d2ea8a8c6a60e7751769895
Remediation
- Emails from unknown senders should always be treated with caution.
- Never trust or open ” links and attachments received from unknown sources/senders.
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls