Extracted

• • Target

    sample.zip

  • Size

    838KB

  • MD5

    eba2304fe0edcdaed4b92e10f3cc01f0

  • SHA1

    fc5cf821358fb8b4c18410ff1d1a69bf5c37edb0

  • SHA256

    d81cfd03427f725fa3b091cb85d021930f85676633466bfa5b45feecc9b281ae

  • SHA512

    3771bb18e50c368abafb3dc38989a3bcbbe08b44e3b6bc860f29d852e7f19d45237939935784969807133d3a79add8247d13a35e3235a025b81f920d317426fe

  Score

  1^/10
  behavioral1behavioral2

• • Target

    sample/docs.bat

  • Size

    39B

  • MD5

    0e5835052158f65cc9d1416a1f26d61d

  • SHA1

    3688a00aa2087f6f7e5b8679c22897e51d0aa063

  • SHA256

    90eba3d92798bc8afa33bb056f79d35fb3efabf6cc87053b13a04254db352a30

  • SHA512

    c4da33631a27436156bbb32a299ebe7017b9c60a5f6fc38e3d111acc2089dd8733ec0f4ed7a6a6b52163c462709c5d1950115dff81758e502458746a21f81499

  Score

  10^/10

  bumblebee6rrevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4

• • Target

    sample/documents.lnk

  • Size

    2KB

  • MD5

    5d48299aa0f1b1b03af9e88b49991a2f

  • SHA1

    8f8f3380f47eeef5219a4e00ed9f9b9c7f7a8c97

  • SHA256

    8d7326d4224dbc0237d7b46969a9b65ce46ad5309627ef9704833cae388f56b1

  • SHA512

    f8cc047e90af1dcf32e7ab49b48fdeead1c379cc22f21c8223ee1045961ce6524aebcde9f02d461942730d673d26b4edbc6eef7320aacfc3412c8e524263cf07

  Score

  10^/10

  bumblebee6rrevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral5behavioral6

• • Target

    sample/palerma3.dll

  • Size

    1.2MB

  • MD5

    87f8ceeaa38c6877b7b44cc6128a6d85

  • SHA1

    c31ed647f179c2e2ed72bfd4beee3cab528f0791

  • SHA256

    048d68e4e4c8b9f8ed590b6722793b96fa77bbf9b1528f091bea8c4e89800186

  • SHA512

    d8444634e2866e81127f0098fe47bd2eaebfb1bdfb1faf71389ee37ccc5f7c9a03ae1a970f37fd922dc54d1cda786d08a6a633d2262e4d97385d62875209ea91

  Score

  10^/10

  bumblebee6rrevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral7behavioral8