Extracted

• • Target

    32ber/32ber.dll

  • Size

    3.2MB

  • MD5

    a899ebf9331b90b5931b73a71362cedc

  • SHA1

    fd53b8071f2843ae08febb214bc6f971c58cf6b6

  • SHA256

    9e5a484d501af67a87c6f0f553360e5dc4c4fbf24c01724cf10eecd34df6be3c

  • SHA512

    176823050ab467f4d0c4163ccca3533acf34b96137406be5ee261d47f4e1181e12c0196bc668750f9024f6d7bcb63d9667ec447fc4cb0bfbb387a2d7cbaa3fae

  Score

  10^/10

  bumblebee1904revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    32ber/qsdqsd.lnk

  • Size

    1KB

  • MD5

    b45fa425a03c562272d570d2c5f6e421

  • SHA1

    68e1fe09e4e772c9e4f8887081a7664da77fca6b

  • SHA256

    9cabff084b106f1de0027a3038bd5343ec22d9f1d132808498d290a1260157e7

  • SHA512

    15c8907ae8fc9d2e49eec6c8ea55f06216ff0611e201023c018cff5ad15685e8e2d6c4c2b6da4feb99b5e0913cebd8a7c5540f10986374d322945620a5efc21b

  Score

  10^/10

  bumblebee1904revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4