YARA · Check Point (via Open-Source-YARA-rules)
CHECK_POINT_Malware_Bumblebee_Packed
Detects the packer used by bumblebee, the rule is based on the code responsible for allocating memory for a critical structure in its logic.
- Author
- Marc Salinas @ CheckPoint Research
- Date
- 2022-07-13
- Modified
- 2023-04-10
- Score / Quality
- 75 / 85
What this rule detects
Detects the packer used by bumblebee, the rule is based on the code responsible for allocating memory for a critical structure in its logic.
Associated malware family: BumbleBee.
It defines 1 patterns (0 text, 1 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Check Point (via Open-Source-YARA-rules), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: Marc Salinas @ CheckPoint Research
Source repository: Check Point (via Open-Source-YARA-rules) @ ec0056f767
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 35f00c87-c26e-5189-b66d-15d5a1b1dd20
Metadata
| malware_family | BumbleBee |
|---|---|
| dll_jul | 6bc2ab410376c1587717b2293f2f3ce47cb341f4c527a729da28ce00adaaa8db |
| dll_jun | 82aab01a3776e83695437f63dacda88a7e382af65af4af1306b5dbddbf34f9eb |
| dll_may | a5bcb48c0d29fbe956236107b074e66ffc61900bc5abfb127087bb1f4928615c |
| iso_jul | ca9da17b4b24bb5b24cc4274cc7040525092dffdaa5922f4a381e5e21ebf33aa |
| iso_jun | 13c573cad2740d61e676440657b09033a5bec1e96aa1f404eed62ba819858d78 |
| iso_may | b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e |
| zip_jun | 7024ec02c9670d02462764dcf99b9a66b29907eae5462edb7ae974fe2efeebad |
| zip_may | 68ac44d1a9d77c25a97d2c443435459d757136f0d447bfe79027f7ef23a89fce |
Related rules
- MalwareSEKOIA.IO Community· Sekoia.io· 2022-05-23
- MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-08
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- MalwareCAPE Sandbox (CAPEv2)· enzo & kevoreilly· 2022-04-21
- MalwareCAPE Sandbox (CAPEv2)· enzok· 2022-04-21
- MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2022-04-21