Trojan.Win64.BUMBLELOADER.YXDIBZ

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Se finaliza a sí misma si detecta que está siendo ejecutada en un entorno virtual.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Termina su ejecución cuando encuentra los siguientes procesos en la memoria del sistema afectado:

• vmtoolsd.exe
• vmwaretray.exe
• vmwareuser.exe
• VGAuthService.exe
• vmacthlp.exe
• VMSrvc.exe
• VMUSrvc.exe
• qemu-ga.exe
• vdagent.exe
• vdservice.exe

Otros detalles

Se finaliza a sí misma si detecta que está siendo ejecutada en un entorno virtual.

Hace lo siguiente:

• It terminates itself if the system's MAC address starts in the following:
  • 00:05:69
  • 00:0C:29
  • 00:1C:14
  • 00:50:56
• It terminates itself if the malware name matches the following:
  • sample.exe
  • bot.exe
  • sandbox.exe
  • malware.exe
  • test.exe
  • klvme.exe
  • myapp.exe
  • testapp.exe
  • It terminates itself if the following directories are found in the system:
    • qemu-ga
    • SPICE Guest Tools
  • It uses Domain Generation Algorithm (DGA) with ".life" TLD to connect and receive data from the following URLs:
    • https://{BLOCKED}1zeiu.life
    • https://{BLOCKED}2ot5u.life
    • https://{BLOCKED}i5kwx.life
    • https://{BLOCKED}1xnl9.life
    • https://{BLOCKED}wt1ao.life