ISC DIARY: EXOTIC LILY --> BUMBLEBEE --> COBALT STRIKE

显示全部楼层 · 发表于 2022-5-20 09:48:00

ISC DIARY: EXOTIC LILY --> BUMBLEBEE --> COBALT STRIKE

Shown above:  Flow chart for infection discussed in this diary.

Shown above:  Malicious TransferXL URL delivering malware.

Shown above:  Downloaded ISO file mounted as a disk image containing Windows shortcut and hidden malware DLL.

Shown above:  Initial infection activity with Bumblebee C2 traffic filtered in Wireshark.

Shown above:  Encrypted (HTTPS) traffic to an amazonAWS server.

Shown above:  Traffic from the infection showing Cobalt Strike activity.

显示全部楼层 · 发表于 2022-5-20 10:04:34

显示全部楼层 · 发表于 2022-5-20 10:07:13

卡巴Kill

显示全部楼层 · 发表于 2022-5-20 10:09:14

AVG解压自动2X

显示全部楼层 · 发表于 2022-5-20 10:55:34

EIS全杀

显示全部楼层 · 发表于 2022-5-20 10:58:01

奇安信杀4个

显示全部楼层 · 发表于 2022-5-20 11:07:10

@00006666
样本如何运行？

显示全部楼层 · 发表于 2022-5-20 11:16:24

显示全部楼层 · 发表于 2022-5-20 12:10:55

trendmicro
Threat: Trojan.Win64.BUMBLELOADER.YXCESZ
Source: Threat
Affected Files: D:\Virus\2022-05-18-Tran…\spc.dll

显示全部楼层 · 发表于 2022-5-20 19:20:41

本帖最后由真小读者于 2022-5-20 19:30 编辑

咖啡 1X

2022/05/20 19:19:40 C:\Users\XXXX\Downloads\2022-05-18-TransferXL-Bumblebee-malware-samples\spc.dll 1 2 JTI/Suspect.196612!e34a3b110c87 88c07354f1d7b0485452d5c39dc1a6d73884e163bc5489c40adc6662602b4d76

[病毒样本] ISC DIARY: EXOTIC LILY --> BUMBLEBEE --> COBALT STRIKE

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块