Extracted

• • Target

    appbuild.exe

  • Size

    3.0MB

  • MD5

    cd2cce5e7cc63f6947305cfe8509d3a9

  • SHA1

    677517444d5311991874856e9a56959eb4f22eb0

  • SHA256

    9d75278f48c145f9bdb1c7916ab92965fa5a079de0fd8d22a894b2307b80f2c1

  • SHA512

    f3ee3854340906a127f24ed0bb1eb56c53abef4e4fbb1472a6b2cda1ad9fe51dff1cf0ff19e707c47fe0e415381ac8ab2c3ed08a1ac15902262cd4992417047d

  Score

  10^/10

  bumblebeeleg1evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    documents.lnk

  • Size

    1KB

  • MD5

    63249b1d5afdb63750f55dad00e211d0

  • SHA1

    116046209898e4d4004dfa7517d56416cc360190

  • SHA256

    467d6e92d3a3c27b2e6c0c75ce20a031c3408f1a58ff09dd5f2c60d6996ad4a0

  • SHA512

    697ebc4a06f65c0409be386b8655024ee59d99ed588eb0c59ec00daec64e2623c74279f411719f152bfd5fb0eb21f07790755d7ba6373891e8eca89985166e51

  Score

  10^/10

  bumblebeeleg1evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4