SHA1:
f004c09428f2f18a145212a9e55eef3615858f9c 7d4a6976c1ece81e01d1f16ac5506266d5210734

Stay tuned for our report on Qakbot's comeback!

[CTI insights]

The latest Qakbot payload distributed happened to be packed by the Dave crypter. The DLL decrypts a resource containing Dave's encrypted shellcode and executes it! (cf. securityintelligence.com/x-force/tric...)

3/ Code analysis of different sample revealed the use of a “morpher”, an advanced tool to evade detection:

1/ Intrinsec’s CTI team recently published a report on Lumma Stealer, the most active stealer of the last months

The RAR archive contains a legitimate PDF taken from the New Zealand Foreign Affairs & Trade weekly global report of October 2023 which launches an EXE with the same name by leveraging CVE-2023-38831.
RAR archive :
www.virustotal.com/gui/file/35f...
Bumblebee EXE :
www.virustotal.com/gui/file/60f...

New #Bumblebee campaign leveraging CVE-2023-38831
Botnet ID : is0210
RC4 key : NEW_BLACK
C2 : g7qf7ew5c[.]life
TTPs : .RAR -> .EXE

5/6

4/6