--- title: Bumblebee Loader description: Earlier this month, Palo Alto’s Unit 42 reported on recent activity leveraging Bumblebee, a loader multiple threat actors have used to replace BazarLoader. --- [Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io) # [Bumblebee Loader](https://blog.polyswarm.io/bumblebee-loader) Written by [PolySwarm Tech Team](https://blog.polyswarm.io/author/polyswarm-tech-team) | Aug 25, 2022 5:48:41 PM **Related Families:** BazarLoader, BazaLoader, Conti, BazarBackdoor, Trickbot, Diavol, Sliver, Bokbot, Meterpreter, Cobalt Strike **Verticals Targeted:** Multiple Executive Summary Earlier this month, Palo Alto’s Unit 42 [reported](https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/) on recent activity leveraging Bumblebee. Unit 42 observed activity by multiple threat actors, including Projector Libra. Key Takeaways - Bumblebee emerged in early 2022 as a replacement for BazarLoader and is used by multiple threat actors. - Recently observed infection vectors for Bumblebee use ISO images. - Bumblebee includes mechanisms for anti-analysis checks and maintaining persistence. - Bumblebee is used to drop multiple follow-up payloads, including ransomware and Cobalt Strike. **What is Bumblebee?** Earlier this month, Palo Alto’s Unit 42 [reported](https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/) on recent activity leveraging Bumblebee, a replacement for BazarLoader that targets Windows machines. Unit 42 observed multiple threat actors leveraging Bumblebee, including the financially motivated initial access broker Projector Libra, also known as Exotic Lily. **BazarLoader Replacement** Bumblebee’s predecessor BazarLoader was observed in the wild as early as April 2020. BazarLoader was used by multiple threat actors, including  [TA551](https://attack.mitre.org/groups/G0127/), [TA578](https://vuldb.com/?actor.ta578), and the threat actors responsible for the [BazarCall](https://unit42.paloaltonetworks.com/bazarloader-malware/) campaign. Around February or March 2022, Bumblebee emerged as a replacement for BazarLoader. Bumblebee’s name was derived from its use of “bumblebee” in the user-agent string generated during post-infection HTTPS traffic. **Infection Vector** In the incident Unit 42 investigated, Projector Libra threat actors sent an email to a potential victim. If the victim responded, the threat actors sent a follow-up email telling the victim to expect an email from a file sharing service with a file relevant to the email discussion. One of the legitimate file-sharing services leveraged by the threat actors is TransferXL. The file-sharing email, of course, contains a link to malware masquerading as the file of interest. Most of the files are ISO images containing a Windows shortcut and the Bumblebee loader. The threat actors used multiple methods to hide the loader. In some cases, the ISO image leverages a .LNK file that runs a hidden DLL. In other cases, the ISO image uses a password-protected .7Z archive file containing the Bumblebee DLL, and the LNK file runs a hidden copy of 7-Zip to extract Bumblebee. According to malware researcher Eli Salem, Bumblebee uses a [unique](https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056) unpacking mechanism. **C2 Communication** NCC Group [reported](https://research.nccgroup.com/2022/04/29/adventures-in-the-land-of-bumblebee-a-new-malicious-loader/) on Bumblebee earlier this year. NCC Group analyzed samples from as early as September 2021. They noted Bumblebee’s backend is written in Golang. The Bumblebee samples analyzed by NCC Group used an export function with the name ‘SetPath.’ Bumblebee performs a series of anti-analysis checks, leveraging the open-source [Al-Khasar](https://github.com/LordNoteworthy/al-khaser) project. Bumblebee then initiates communication to the C2. According to NCC Group, Bumblebee receives commands from the C2 and executes one of the following tasks: - **shi** - injects a task’s data into a new process, where the process images paths are embedded in the binary and randomly selected - **dij** - injects a task’s data into a new process, where the process images paths are embedded in the binary and randomly selected, and the injection method differs from the method used in task dij - **dex** - writes a task’s data to a file named wab.exe in the Windows App Data folder - **sdl** - deletes the loader’s binary from the disk - **ins** - creates persistence on the victim machine **Persistence** To maintain persistence, Bumblebee creates a new directory in the Windows AppData folder with a name generated based on the client\_id MD5 value. It then copies itself to a new directory and creates a VBS file with the following content: *Set objShell = CreateObject(“Wscript.Shell”)* *objShell.Run “rundll32.exe my\_application\_path, IternalJob”* Bumblebee then creates a scheduled task with the path %WINDIR%\\\\System32\\\\wscript.exe VBS\_Filepath. **Payloads** In an Active Directory environment, Bumblebee loads Cobalt Strike, which threat actors can use to map the target’s environment. Bumblebee is also used to drop, Sliver, shellcode, or Meterpreter. If the threat actors deem the target to be high value, they may follow up by dropping ransomware. Ransomware families dropped have included Conti and Diavol. IOCs PolySwarm has multiple samples of Bumblebee. Below is a selection of hashes from our most recent Bumblebee samples. **First Seen** [c2e8377cc13f78ca5eb0d923adfcdf00159c235906eb72ef486d0a9b9c8f93cb](https://polyswarm.network/scan/results/file/c2e8377cc13f78ca5eb0d923adfcdf00159c235906eb72ef486d0a9b9c8f93cb) [793fd1b968818806aace2681a6d79fe9ba2935e75c76c71d353e243732ef8dbd](https://polyswarm.network/scan/results/file/793fd1b968818806aace2681a6d79fe9ba2935e75c76c71d353e243732ef8dbd) [6195f27a544415369b26df60ca75e6f7cf84c1f0350e4724c81ed51233f685c3](https://polyswarm.network/scan/results/file/6195f27a544415369b26df60ca75e6f7cf84c1f0350e4724c81ed51233f685c3) [550f0c6f48d7bd761bd5b728c6cc7452c3a220ecc4e07598522534abc85c764e](https://polyswarm.network/scan/results/file/550f0c6f48d7bd761bd5b728c6cc7452c3a220ecc4e07598522534abc85c764e) [7c942cdd40a2b5b784496e4f422df61f5d7ff49486054d841dd47d65af664025](https://polyswarm.network/scan/results/file/7c942cdd40a2b5b784496e4f422df61f5d7ff49486054d841dd47d65af664025) [f1f7b1c5225480bf6c40e595ac00b2196a1fb8e5b246c05224022e6867702116](https://polyswarm.network/scan/results/file/f1f7b1c5225480bf6c40e595ac00b2196a1fb8e5b246c05224022e6867702116) [86cbd601461bd40e0918e5a571e59d6911eea5111a41f828ba3e780d54551876](https://polyswarm.network/scan/results/file/86cbd601461bd40e0918e5a571e59d6911eea5111a41f828ba3e780d54551876) [8711308e9a44a293023edf1421d0687d18f734575961869c8490389307ef4283](https://polyswarm.network/scan/results/file/8711308e9a44a293023edf1421d0687d18f734575961869c8490389307ef4283) [024d048f8ce81e8784215dc6cf0e170b02307d9e8624083efdfccaf3e269a0f2](https://polyswarm.network/scan/results/file/024d048f8ce81e8784215dc6cf0e170b02307d9e8624083efdfccaf3e269a0f2) **Other Hashes** [96ec0ab0b7962fc07fcb2ac10a6993865b86391cddf6f82876bae558185b8ae9](https://polyswarm.network/scan/results/file/96ec0ab0b7962fc07fcb2ac10a6993865b86391cddf6f82876bae558185b8ae9) [636a5cc92d1014e0784cc22200024c1047dbf35af33d7dffda0947806413713a](https://polyswarm.network/scan/results/file/636a5cc92d1014e0784cc22200024c1047dbf35af33d7dffda0947806413713a) [3a57c15797d2f7a85b51544365129629ef468af2b33d74755faad6caed5a5ecc](https://polyswarm.network/scan/results/file/3a57c15797d2f7a85b51544365129629ef468af2b33d74755faad6caed5a5ecc) [fe7a64dad14fe240aa026e57615fc3a22a753f5ba1dd55d675b1d2072f6262a1](https://polyswarm.network/scan/results/file/fe7a64dad14fe240aa026e57615fc3a22a753f5ba1dd55d675b1d2072f6262a1) [5eb41baadae307a7839685fd6f883e123408183fdc88a0da8e0e6aa8521b6812](https://polyswarm.network/scan/results/file/5eb41baadae307a7839685fd6f883e123408183fdc88a0da8e0e6aa8521b6812) [bc7d1ff5594f8cc82553c070b5b23b375ee70ad8400fcf5b11a4ef250f957510](https://polyswarm.network/scan/results/file/bc7d1ff5594f8cc82553c070b5b23b375ee70ad8400fcf5b11a4ef250f957510) [b0d28720c4f96b3dc22872b366ff19a5f48e92ae5f538afe0350adf8e608ed57](https://polyswarm.network/scan/results/file/b0d28720c4f96b3dc22872b366ff19a5f48e92ae5f538afe0350adf8e608ed57) [aacfabf91cee9bc469671f35911a49c81f662fbfb8c941968ca62473bf0fd754](https://polyswarm.network/scan/results/file/aacfabf91cee9bc469671f35911a49c81f662fbfb8c941968ca62473bf0fd754) [e6c6ad0411501c2d81863c0ecaf80ace8a5e9b6ce8329c5700890eb36991f6fb](https://polyswarm.network/scan/results/file/e6c6ad0411501c2d81863c0ecaf80ace8a5e9b6ce8329c5700890eb36991f6fb) [f0fdc0b64b747f348a87a382ff5dfe016107f95ab5953318cc8d9548a983efd1](https://polyswarm.network/scan/results/file/f0fdc0b64b747f348a87a382ff5dfe016107f95ab5953318cc8d9548a983efd1) [3932c3fd347bd0d4afb906d10cfecc03114963d8ac9b25c9b6f91ab0ca5ee8db](https://polyswarm.network/scan/results/file/3932c3fd347bd0d4afb906d10cfecc03114963d8ac9b25c9b6f91ab0ca5ee8db) [10e628c35c0f19aa4a8b00bafd9d15862fe6eda354a70c8e7911a7ccf4f50027](https://polyswarm.network/scan/results/file/10e628c35c0f19aa4a8b00bafd9d15862fe6eda354a70c8e7911a7ccf4f50027) [dcf367f4014c302e9f1ef3b3337a31eca7d289d5f3abadef604aacce811f9b50](https://polyswarm.network/scan/results/file/dcf367f4014c302e9f1ef3b3337a31eca7d289d5f3abadef604aacce811f9b50) [d15ba765332f3bde378797ce7c1b2eda17eda51f1488b675ab96161165c936ba](https://polyswarm.network/scan/results/file/d15ba765332f3bde378797ce7c1b2eda17eda51f1488b675ab96161165c936ba) [6771f6782cc7730936e0e1682bddb5a003b01c6b399e113cdaa7555fa94a5d11](https://polyswarm.network/scan/results/file/6771f6782cc7730936e0e1682bddb5a003b01c6b399e113cdaa7555fa94a5d11) [c1b266b068dd577706f7db9a8b3a4f269e7f56b541fffb34f7297234e803c2c6](https://polyswarm.network/scan/results/file/c1b266b068dd577706f7db9a8b3a4f269e7f56b541fffb34f7297234e803c2c6) We currently have **over 700** Bumblebee samples in our portal. You can use the following CLI command to search for all Bumblebee samples in our portal: ***$ polyswarm link list -f BumbleBee Don’t have a PolySwarm account? Go [here](https://polyswarm.network/) to sign up for a free Community plan or to subscribe. Contact us at [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) | Check out our [blog](https://blog.polyswarm.io/) | [Subscribe](https://polyswarm.io/ransomwarereport/) to our reports*** [View full post](https://blog.polyswarm.io/bumblebee-loader) ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "PolySwarm Tech Team" }, "dateModified" : "2022-08-25T17:48:41.097Z", "datePublished" : "2022-08-25T17:48:41Z", "headline" : "Bumblebee Loader", "image" : { "@type" : "ImageObject", "height" : 1407, "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/BUMBLEBEE_Twitter.jpg", "width" : 2500 }, "mainEntityOfPage" : "https://blog.polyswarm.io/bumblebee-loader", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : 60.0, "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png", "width" : 59.820896 }, "name" : "The PolySwarm Blog" } } ```