Procedure examples

Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.

Bumblebee can use backup C2 servers if the primary server fails.

Bumblebee can check the Registry for specific keys.

Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.

Bumblebee has the ability to identify the user name.

Bumblebee has named component DLLs "RapportGP.dll" to match those used by the security company Trusteer.

Bumblebee can send collected data in JSON format to C2.

Bumblebee can use WMI to gather system information and to spawn processes for code injection.

Bumblebee can achieve persistence by copying its DLL to a subdirectory of %APPDATA% and creating a Visual Basic Script that will load the DLL via a scheduled task.

Bumblebee can inject code into multiple processes on infected endpoints.

The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes.

Bumblebee can use asynchronous procedure call (APC) injection to execute commands received from C2.

Bumblebee can identify processes associated with analytical tools.

Bumblebee can use PowerShell for execution.

Bumblebee can use `cmd.exe` to drop and run files.

Bumblebee can create a Visual Basic script to enable persistence.

Bumblebee can uninstall its loader through the use of a `Sdl` command.

Bumblebee can enumerate the OS version and domain on a targeted system.

Bumblebee has been downloaded to victim's machines from OneDrive.

Bumblebee can download and execute additional payloads including through the use of a `Dex` command.

Bumblebee can use multiple Native APIs.

Bumblebee can use `LoadLibrary` to attempt to execute GdiPlus.dll.

Bumblebee has the ability to base64 encode C2 server responses.

Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.

Bumblebee has relied upon a user downloading a file from a OneDrive link for execution.

Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs.

Bumblebee can use `odbcconf.exe` to run DLLs on targeted hosts.

Bumblebee has used `rundll32` for execution of the loader component.

Bumblebee has the ability to perform anti-virtualization checks.

Bumblebee has the ability to search for designated file paths and Registry keys that indicate a virtualized environment from multiple products.

Bumblebee has the ability to set a hardcoded and randomized sleep interval.

Bumblebee can identify specific analytical tools based on running processes.

Bumblebee has the ability to bypass UAC to deploy post exploitation tools with elevated privileges.

Bumblebee can use a COM object to execute queries to gather system information.

Bumblebee can compress data stolen from the Registry and volume shadow copies prior to exfiltration.

Bumblebee has gained execution through luring users into opening malicious attachments.

Bumblebee has been spread through e-mail campaigns with malicious links.

Bumblebee can encrypt C2 requests and responses with RC4

Bumblebee can search for tools used in static analysis.