Written in C++, Bumblebee is mostly condensed in a single function responsible for initialization, handling of responses, and sending requests. At the moment, the downloader’s configuration is stored in plaintext, but its developers may start employing obfuscation in the future.
Once executed on a victim machine, the threat collects information about the system and then starts communicating with the command and control (C&C) server. Based on the amount of time it takes for Bumblebee to receive jobs to execute, payloads are likely manually deployed.
