win.bumblebee (Back to overview)



Actor(s): GOLD CABIN, TA578, TA579


This malware is delivered by an ISO file, with an DLL inside with a custom loader. Because of the unique user-agent "bumblebee" this malware was dubbed BUMBLEBEE. At the time of Analysis by Google's Threat Analysis Group (TAG) BumbleBee was observed to fetch Cobalt Strike Payloads.

2024-02-13ProofpointAxel F, Selena Larson
Bumblebee Buzzes Back in Black
2023-10-04Twitter (@Intrisec)CTI Intrinsec
Tweet about new Bumblebee campaign leveraging CVE-2023-38831
2023-09-15Johannes Bader's BlogJohannes Bader
The DGA of BumbleBee
2023-09-11Twitter (@Artilllerie)@Artilllerie
Tweet on BumbleBee sample containing a DGA
2023-09-07Twitter (@Intrisec)CTI Intrinsec
Tweets on Bumblebee campaign spreading via Html smuggling downloading RAR archive with European Central Bank PDF lure and folder containing Bumblebee EXE payload.
2023-09-01VMRayEmre Güler
Understanding BumbleBee: BumbleBee’s malware configuration and clusters
2023-08-18VMRayEmre Güler
Understanding BumbleBee: The malicious behavior of BumbleBee
2023-08-09VMRayEmre Güler
Understanding BumbleBee: The delivery of Bumblee
2023-07-11SpamhausSpamhaus Malware Labs
Spamhaus Botnet Threat Update Q2 2023
Hydra AsyncRAT Aurora Stealer Ave Maria BumbleBee Cobalt Strike DCRat Havoc IcedID ISFB NjRAT QakBot Quasar RAT RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Tofsee
2023-06-22DeepInstinctDeep Instinct Threat Lab, Mark Vaitzman, Shaul Vilkomir-Preisman
PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID
PindOS BumbleBee PhotoLoader
2023-06-08VMRayPatrick Staubmann
Busy Bees - The Transformation of BumbleBee
BumbleBee Cobalt Strike Conti Meterpreter Sliver
2023-04-20SecureworksCounter Threat Unit ResearchTeam
Bumblebee Malware Distributed Via Trojanized Installer Downloads
BumbleBee Cobalt Strike
2023-04-18Twitter (@threatinsight)Threat Insight
Tweet on TA581 using Keitaro TDS URL to download a .MSI file to deliver BumbleBee malware
2023-04-16YouTube (botconf eu)Crowdstrike Technical Analysis Cell (TAC), Suweera De Souza
Tracking Bumblebee’s Development
2023-04-16BotconfSuweera De Souza
Tracking Bumblebee’s Development
2023-04-12SpamhausSpamhaus Malware Labs
Spamhaus Botnet Threat Update Q1 2023
FluBot Amadey AsyncRAT Aurora Ave Maria BumbleBee Cobalt Strike DCRat Emotet IcedID ISFB NjRAT QakBot RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Tofsee Vidar
2023-04-11SEC ConsultAngelo Violetti
BumbleBee hunting with a Velociraptor
2023-03-29KrakzPierre Le Bourhis
BumbleBee notes
2023-03-28CerberoErik Pistelli
Reversing Complex PowerShell Malware
2023-03-040xToxin Labs@0xToxin
Bumblebee DocuSign Campaign
2023-02-03MandiantGenevieve Stark, Kimberly Goody
Float Like a Butterfly Sting Like a Bee
BazarBackdoor BumbleBee Cobalt Strike
2023-01-19CiscoGuilherme Venere
Following the LNK metadata trail
BumbleBee PhotoLoader QakBot
2023-01-09IntrinsecCTI Intrinsec, Intrinsec
Emotet returns and deploys loaders
BumbleBee Emotet IcedID PHOTOLITE
2022-11-16ProofpointAxel F, Pim Trouerbach
A Comprehensive Look at Emotet Virus’ Fall 2022 Return
BumbleBee Emotet PHOTOLITE
2022-11-10IntezerNicole Fishbein
How LNK Files Are Abused by Threat Actors
BumbleBee Emotet Mount Locker QakBot
2022-10-27MicrosoftMicrosoft Threat Intelligence
Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity
FAKEUPDATES BumbleBee Clop Fauppod Raspberry Robin Roshtyak Silence DEV-0950 Mustard Tempest
2022-10-27MicrosoftMicrosoft Security Threat Intelligence
Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity
FAKEUPDATES BumbleBee Fauppod PhotoLoader Raspberry Robin Roshtyak
2022-10-13SpamhausSpamhaus Malware Labs
Spamhaus Botnet Threat Update Q3 2022
FluBot Arkei Stealer AsyncRAT Ave Maria BumbleBee Cobalt Strike DCRat Dridex Emotet Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT QakBot RecordBreaker RedLine Stealer Remcos Socelars Tofsee Vjw0rm
2022-10-06Twitter (@ESETresearch)ESET Research
Tweet on Bumblebee being modularized like trickbot
2022-10-03Check PointMarc Salinas Fernandez
Bumblebee: increasing its capacity and evolving its TTPs
BumbleBee Cobalt Strike Meterpreter Sliver Vidar
2022-09-26The DFIR ReportThe DFIR Report
BumbleBee: Round Two
BumbleBee Cobalt Strike Meterpreter
Bumblebee Returns With New Infection Technique
BumbleBee Cobalt Strike
2022-09-05Infinitum ITArda Büyükkaya
Bumblebee Loader Malware Analysis
2022-08-24Deep instinctDeep Instinct Threat Lab
The Dark Side of Bumblebee Malware Loader
2022-08-24MicrosoftMicrosoft Security Experts
Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks
BumbleBee Sliver
2022-08-18IBMCharlotte Hammond, Ole Villadsen
From Ramnit To Bumblebee (via NeverQuest): Similarities and Code Overlap Shed Light On Relationships Between Malware Developers
BumbleBee Karius Ramnit TrickBot Vawtrak
2022-08-17CybereasonCybereason Global SOC Team
Bumblebee Loader – The High Road to Enterprise Domain Control
BumbleBee Cobalt Strike
2022-08-10WeixinRed Raindrop Team
Operation(верность) mercenary: a torrent of steel trapped in the plains of Eastern Europe
BumbleBee Cobalt Strike
2022-08-08The DFIR ReportThe DFIR Report
BumbleBee Roasts Its Way to Domain Admin
BumbleBee Cobalt Strike
2022-08-04CloudsekAastha Mittal, Anandeshwar Unnikrishnan
Technical Analysis of Bumblebee Malware Loader
2022-08-03Palo Alto Networks Unit 42Brad Duncan
Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware
BazarBackdoor BumbleBee Cobalt Strike Conti
Shortcut-Based (LNK) Attacks Delivering Malicious Code On The Rise
AsyncRAT BumbleBee Emotet IcedID QakBot
2022-07-07FortinetErin Lin
Notable Droppers Emerge in Recent Threat Campaigns
BumbleBee Emotet PhotoLoader QakBot
2022-07-07IBMCharlotte Hammond, Kat Weinberger, Ole Villadsen
Unprecedented Shift: The Trickbot Group is Systematically Attacking Ukraine
AnchorMail BumbleBee Cobalt Strike IcedID Meterpreter
2022-06-28SymantecThreat Hunter Team, Vishal Kamble
Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem
2022-06-14RiskIQJordan Herman
RiskIQ: Identifying BumbleBee Command and Control Servers
2022-06-13SekoiaThreat & Detection Research Team
BumbleBee: a new trendy loader for Initial Access Brokers
Bumblebee Loader on The Rise
BumbleBee Cobalt Strike
2022-05-25Team CymruS2 Research Team
Bablosoft; Lowering the Barrier of Entry for Malicious Actors
BlackGuard BumbleBee RedLine Stealer
Buzz of the Bumblebee – A new malicious loader
2022-05-19InfoSec Handlers Diary BlogBrad Duncan
Bumblebee Malware from TransferXL URLs
BumbleBee Cobalt Strike
2022-05-19InfoSec Handlers Diary BlogBrad Duncan
Bumblebee Malware from TransferXL URLs
BumbleBee Cobalt Strike
2022-05-12OALabsSergei Frankoff
Taking a look at Bumblebee loader
2022-05-12Intel 471Intel 471
What malware to look for if you want to prevent a ransomware attack
Conti BumbleBee Cobalt Strike IcedID Sliver
2022-05-11SANS ISCBrad Duncan
TA578 using thread-hijacked emails to push ISO files for Bumblebee malware
2022-05-11InfoSec Handlers Diary BlogBrad Duncan
TA578 using thread-hijacked emails to push ISO files for Bumblebee malware
BumbleBee Cobalt Strike IcedID PhotoLoader
2022-05-08Threat hunting with hints of incident responseJouni Mikkola
Bzz.. Bzz.. Bumblebee loader
2022-04-29NCC GroupMike Stokkel, Nikolaos Pantazopoulos, Nikolaos Totosis
Adventures in the land of BumbleBee – a new malicious loader
BazarBackdoor BumbleBee Conti
2022-04-28ProofpointKelsey Merriman, Pim Trouerbach
This isn't Optimus Prime's Bumblebee but it's Still Transforming
BumbleBee TA578 TA579
2022-04-28Bleeping ComputerIonut Ilascu
New Bumblebee malware replaces Conti's BazarLoader in cyberattacks
2022-04-27Medium elis531989Eli Salem
The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection
BumbleBee TrickBot
2022-04-14CynetMax Malyutin
Orion Threat Alert: Flight of the BumbleBee
BumbleBee Cobalt Strike
2022-03-17GoogleBenoit Sevens, Vladislav Stolyarov
Exposing initial access broker with ties to Conti
BazarBackdoor BumbleBee Conti EXOTIC LILY
2022-03-17GoogleBenoit Sevens, Google Threat Analysis Group, Vladislav Stolyarov
Exposing initial access broker with ties to Conti
BazarBackdoor BumbleBee Cobalt Strike Conti
2022-01-01aspiretsMichael Lamb
Bumblebee Malware Loader: Threat Analysis
2021-09-10GigamonJoe Slowik
Rendering Threats: A Network Perspective
BumbleBee Cobalt Strike
2021-09-09Trend MicroTrend Micro
Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs
BumbleBee Cobalt Strike
Yara Rules
[TLP:WHITE] win_bumblebee_auto (20230808 | Detects win.bumblebee.)
rule win_bumblebee_auto {

        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.bumblebee."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = ""
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.

        $sequence_0 = { 0fb7570e 6623d1 740d 0fbe470d b90d000000 2bc8 }
            // n = 6, score = 2800
            //   0fb7570e             | dec                 eax
            //   6623d1               | test                eax, eax
            //   740d                 | je                  0x139
            //   0fbe470d             | cmove               eax, ecx
            //   b90d000000           | cmp                 dword ptr [eax + ebx], 0
            //   2bc8                 | je                  0x7b

        $sequence_1 = { 0f44c1 833c1800 7475 837c180400 746e 8b1418 488b05???????? }
            // n = 7, score = 2800
            //   0f44c1               | mov                 edx, dword ptr [esp + 0x48]
            //   833c1800             | dec                 eax
            //   7475                 | lea                 ecx, [esp + 0x38]
            //   837c180400           | dec                 eax
            //   746e                 | mov                 dword ptr [esp + 0x20], ecx
            //   8b1418               | js                  0x146
            //   488b05????????       |                     

        $sequence_2 = { 0f88cc000000 4863533c 488b05???????? 4803d6 4885c0 0f84b5000000 488d4c2430 }
            // n = 7, score = 2800
            //   0f88cc000000         | js                  0xd2
            //   4863533c             | dec                 eax
            //   488b05????????       |                     
            //   4803d6               | arpl                word ptr [ebx + 0x3c], dx
            //   4885c0               | dec                 eax
            //   0f84b5000000         | add                 edx, esi
            //   488d4c2430           | dec                 eax

        $sequence_3 = { 0f880c010000 488b7580 4885f6 0f84ff000000 488b05???????? 4885c0 0f84ef000000 }
            // n = 7, score = 2800
            //   0f880c010000         | mov                 dword ptr [esp + 0x28], 0x8000000
            //   488b7580             | dec                 esp
            //   4885f6               | lea                 eax, [ebp - 0x30]
            //   0f84ff000000         | dec                 eax
            //   488b05????????       |                     
            //   4885c0               | mov                 dword ptr [ebp - 0x28], esi
            //   0f84ef000000         | lea                 eax, [esi + 0x40]

        $sequence_4 = { 0f8895000000 8b7b28 b8c0000000 4803fe ba64860000 66395304 8d4810 }
            // n = 7, score = 2800
            //   0f8895000000         | js                  0xd2
            //   8b7b28               | dec                 eax
            //   b8c0000000           | arpl                word ptr [ebx + 0x3c], dx
            //   4803fe               | dec                 eax
            //   ba64860000           | add                 edx, esi
            //   66395304             | dec                 eax
            //   8d4810               | test                eax, eax

        $sequence_5 = { 0fbec0 8d59e8 8d1c58 ffc2 }
            // n = 4, score = 2800
            //   0fbec0               | dec                 eax
            //   8d59e8               | arpl                word ptr [ebx + 0x3c], dx
            //   8d1c58               | dec                 eax
            //   ffc2                 | add                 edx, esi

        $sequence_6 = { 0f57c0 c744242800000008 4c8d45d0 488975d8 8d4640 488975e0 }
            // n = 6, score = 2800
            //   0f57c0               | add                 edi, esi
            //   c744242800000008     | js                  0x146
            //   4c8d45d0             | dec                 eax
            //   488975d8             | test                eax, eax
            //   8d4640               | je                  0x139
            //   488975e0             | dec                 eax

        $sequence_7 = { 0f8840010000 488b05???????? 4885c0 0f8430010000 488b542448 488d4c2438 48894c2420 }
            // n = 7, score = 2800
            //   0f8840010000         | mov                 eax, 0xc0
            //   488b05????????       |                     
            //   4885c0               | dec                 eax
            //   0f8430010000         | add                 edi, esi
            //   488b542448           | mov                 edx, 0x8664
            //   488d4c2438           | cmp                 word ptr [ebx + 4], dx
            //   48894c2420           | js                  0x9b

        7 of them and filesize < 4825088
[TLP:WHITE] win_bumblebee_w0   (20220330 | BumbleBee / win.bumblebee)
rule win_bumblebee_w0 {
        author = "@AndreGironda"
        description = "BumbleBee / win.bumblebee"
        reference_md5 = "e6a046d1baa7cd2100bdf48102b8a144"
	    date = "March 29, 2022"
	    tlp = "White"

    malpedia_rule_date = "20220330"
    malpedia_hash = ""
	malpedia_reference = ""
	malpedia_version = "20220330"
	malpedia_license = "CC BY-NC-SA 4.0"
	malpedia_sharing = "TLP:WHITE"
	$hex_140001d53 = { 48 8b 05 06 44 00 00 41 81 ea 06 28 00 00 49 31 80 48 02 00 00 49 8b 80 c8 00 00 00 48 05 28 01 00 00 48 01 41 08 49 8b }
	$hex_18000927a = { 48 8d 4c 24 50 e8 cc cc ff ff 90 4c 8d 45 b0 48 8d 54 24 50 48 8d 8d 00 01 00 00 e8 26 d3 ff ff 90 48 8b 44 24 68 48 83 f8 10 72 4a 48 ff c0 48 }
        any of them
Download all Yara Rules