New JavaScript-Based Dropper Delivers Bumblebee and IcedID Malware

Summary: [emaillocker id="1283"]

Researchers discovered a new variant of a JavaScript-based dropper that distributes Bumblebee and IcedID malware. The dropper includes Russian comments and uses a unique user-agent string "PindOS," potentially referencing anti-American sentiment in Russia. Bumblebee, linked to the Conti group, acts as a loader for various types of malwares, including ransomware, while IcedID is a banking malware that may be transitioning to a more generalized loader-type malware.

The shift to JavaScript marks a significant change in Bumblebee's tactics, which previously relied on PowerShell. The de-obfuscated dropper is relatively simple, consisting of a single function called "exec" with parameters specifying the user-agent string, download URLs, and payload. The dropper attempts to download the payload and execute it, either directly or using a combination of PowerShell and rundll32.exe.

Infection Chain

The shift to JavaScript marks a significant change in Bumblebee's tactics, which previously relied on PowerShell. The de-obfuscated dropper is relatively simple, consisting of a single function called "exec" with parameters specifying the user-agent string, download URLs, and payload. The dropper attempts to download the payload and execute it, either directly or using a combination of PowerShell and rundll32.exe.

The downloaded payload is saved to a specific location with a randomized filename to evade signature-based detection. However, Bumblebee's generated samples still exhibit some detectable patterns. The DLL payload of Bumblebee has undergone slight modifications, including additional layers of obfuscation and the inclusion of "legitimate looking" strings from the FFmpeg open-source project. Overall, this new strain of the dropper showcases the evolution of Bumblebee and IcedID malware, highlighting the shift towards JavaScript and the adoption of new techniques in their distribution and functionality.

Threat Profile:

References:

The following reports contain further technical details:

https://thehackernews.com/2023/06/powerful-javascript-dropper-pindos.html