How to remove Bumblebee malware from a computer

What kind of malware is Bumblebee?

Bumblebee is the name of a malware loader. It is known that cybercriminals use it as a downloader for Cobalt Strike and possibly other malware such as ransomware. Bumblebee appears to be a replacement for BazaLoader - another malware loader.

More about the Bumblebee malware

Bumblebee is delivered via ISO files that contain malicious DLL and shortcut files (files containing Bumblebee malware). It is quite sophisticated malware that used various methods to evade detection. It can detect virtualization environment processes to avoid running on virtual machines.

The purpose of Bumblebee malware is to download and execute additional payloads - to infect computers with other malware. There is reason to believe that Bumblebee is commonly used by ransomware gangs who aim to encrypt files and force victims to pay a ransom in return for a decryption tool.

Since Bumblebee is designed to drop additional payloads, cybercriminals may use it to inject information stealers, cryptocurrency miners, and other malware. Bumblebee receives commands via the C2 (Command and Control) server. The attackers use it to directly download and execute files, inject malicious DLLs, and establish persistence on the operating system.

Threat Summary:

Name	Bumblebee loader
Threat Type	Malware loader
Detection Names (Malicious ISO File)	Avast (LNK:Agent-BD [Trj]), Combo Cleaner (Gen:Variant.Lazy.164691), ESET-NOD32 (A Variant Of Win64/Kryptik.CZJ), Kaspersky (HEUR:Trojan.Win32.Generic), Microsoft (Program:Win32/Wacapew.C!ml), Full List (VirusTotal)
Detection Names (Bumblebee)	Avast (Win32:TrojanX-gen [Trj]), Combo Cleaner (Trojan.GenericKD.50206978), ESET-NOD32 (A Variant Of Win64/Agent.BEG), Kaspersky (UDS:Trojan.Win64.Shelma.a), Microsoft (Trojan:Win32/Casdet!rfn), Full List (VirusTotal)
Payload	Cobalt Strike, ransomware, and possibly other malware
Symptoms	Bumblebee is designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine. It also can avoid detecion and analysis.
Distribution methods	Infected email attachments, malicious online advertisements, social engineering, software 'cracks'.
Damage	Stolen passwords and banking information, identity theft, the victim's computer added to a botnet.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. ▼ Download Combo Cleaner To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Bumblebee malware in general

Bumblebee is a sophisticated malware downloader that performs anti-virtualization checks and implements unique downloader capabilities. It is used to download and execute additional payloads. It is known that cybercriminals who use Bumblebee have been using the BazaLoader to drop malicious payloads.

How did Bumblebee infiltrate my computer?

Threat actors deliver Bumblebee via malspam campaigns. They send emails containing a malicious attachment (an ISO file). That ISO file contains malicious .dll and shortcut files (DLL and LNK files) that contain Bumblebee. Bumblebee downloader starts after execution of the shortcut (LNK/.lnk) file.

It is important to mention that cybercriminals can use Microsoft Office, PDF documents, executable files, JavaScript files, and other files to deliver malware. As a rule, emails containing malicious links or files are disguised as important/urgent/official letters from legitimate companies or other entities.

How to avoid installation of malware?

Do not open attachments and links in irrelevant emails sent from unknown, suspicious addresses. Update and activate the software with tools provided by the official developers. Always keep the operating system and installed programs up to date. Download software and files from legitimate/official web pages and use direct links.

Do not trust files and programs downloaded via shady websites, third-party downloaders, P2P networks, etc. Have reputable antivirus software installed on a computer and perform system scans regularly. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Email containing malicious ISO file used to deliver Bumblebee malware:

Text in the email:

Subject: ******** sent you 1 file using TransferXL

Download now this transfer sent to you by clicking in the link in this email.    If you cannot see this email, click here
1 file
1.66 MB

******** sent 1 file to you
prd
Available until Apr 8, 2022 (expires in 6 days)
Download
    
documents-00106.iso
    
Transferred with TransferXL

Screenshot of a deceptive PDF document (distributed via spam emails) containing a download button ("Open") for Bumblebee malware:

Update September 8, 2022 - new infection chain used by Bumblebee has been discovered. As previously observed, the cyber criminals behind Bumblebee continue to use spam campaigns to distribute this malware. The new spam emails contain a password-locked .VHD format attachment. It encompasses two files, one of which is hidden. The .LNK executes the hidden file, which loads Bumblebee into the memory of PowerShell - this then triggers further stages of the infection. More information on these developments can be found in an article on the Cyble Research Blog.

Update May 8, 2023 - new distribution methods used for Bumblebee have been discovered. This malware has been observed being proliferated by employing malicious Google Ads and SEO (Search Engine Optimization) poisoning techniques.

In simpler terms, when a user searches a targeted query, the topmost results are malicious Google Ads that lead to compromised websites promoting files that cause Bumblebee infections. The following legitimate software has been trojanized and/or used as a disguise to spread this malware: Cisco AnyConnect, Zoom, Citrix Workspace, ChatGPT, and others.

Bumblebee malware is still used to deliver Cobalt Strike and, eventually –  ransomware. There have been infection chains noted that also involved Remote Access software like AnyDesk and DameWare, information-stealing malware, and other malicious tools. This suggests that Bumblebee infections intended to culminate with ransomware deployment also include the components necessary for double extortion, where in addition to potential permanent data loss – the victim is threatened with information leaks if they refuse to meet the ransom demands.

Update September 20, 2023 - The Bumblebee malware uses new tricks to spread through 4shared WebDAV services. WebDAV allows remote content management. This campaign began in September, using 4shared to distribute malware while avoiding detection. Bumblebee relies on fake emails with attachments, mainly Windows shortcut LNK files, to trick users.

When opened, these files mount a 4shared WebDAV folder with hardcoded credentials and execute malicious actions. The attackers are experimenting with different methods, likely to optimize their attacks.

In this campaign, an updated version of the Bumblebee malware loader is being used, shifting from WebSocket to TCP for command and control server (C2) communications. The new loader no longer relies on hardcoded C2 addresses but employs a domain generation algorithm (DGA).

Previously linked to ransomware distribution, this change raises concerns due to its more efficient and elusive distribution channel. The adoption of DGA also makes it harder to track and block Bumblebee, adding complexity to preventive measures against this malware loader.

Update February 15, 2024 - In the latest attacks, thousands of emails were sent to US organizations under the guise of "Voicemail February" from the sender "info@quarlesaa[.]com". These emails contained OneDrive URLs leading to Word files like "ReleaseEvans#96.docm".

The Word document, masquerading as material from the Humane company, employed macros to run a script in the Windows temporary directory. This script downloaded and executed a file named "update_ver" from a remote server using PowerShell.

This campaign is noteworthy for its use of VBA macro-enabled documents, a tactic rarely seen among cybercriminals since Microsoft started blocking macros by default in 2022. The attack methods differ significantly from past Bumblebee campaigns, which utilized various techniques such as distributing DLLs, HTML smuggling, WinRAR exploits, password-protected VBS attachments, and zipped LNK files.

Screenshot of the email used in a recent campaign:

Screenshot of the malicious document (before enabling macros):

Screenshot of the malicious document (after enabling macros):

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is Bumblebee?
• STEP 1. Manual removal of Bumblebee malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with Bumblebee malware, should I format my storage device to get rid of it?

It is not necessary to format the infected storage device. Bumblebee malware can be removed by following the instructions provided in our removal guide above.

What are the biggest issues that malware can cause?

It depends on its capabilities. Malware can be used to encrypt files, steal identities, online accounts, infect computers with additional malware, and other purposes.

What is the purpose of Bumblebee malware?

Bumblebee is used as a tool to infect computers with other malware (e.g., ransomware, information stealer, cryptocurrency miner).

How did Bumblebee infiltrate my computer?

This malware is distributed via emails containing a malicious attachment. It is known that cybercriminals use an ISO file containing malicious DLL (.dll) and shortcut (LNK) files to trick users into executing malware. In other cases, malware is distributed via fake updaters, cracked software download pages and other unreliable sources for downloading software.

Will Combo Cleaner protect me from malware?

Yes, Combo Cleaner can detect and remove almost all known malware. It is important to know that high-end malware usually hides deep in the system. Therefore, infected computers must be scanned using a full scan option.

▼ Show Discussion