Extracted

• • Target

    docum.bat

  • Size

    39B

  • MD5

    9b2244d9b15b1186430e2feedf1a1cbc

  • SHA1

    e42ce05798212df517d36cec81435ffb1877c3fd

  • SHA256

    f17420ec26a57d29eefd782b046a8c7be41bc1da1d9bf08313e6fc83ccca333e

  • SHA512

    d0cf589d6d31fa45fa7982e3d817920a4dbd06771f2051c0a3d4e4da92d43f4787e73d666351f473684d1db16e0c04909f1b52e87da1eabc87d6d76e5b24d387

  Score

  10^/10

  bumblebee6rrevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    c89d0d285c1a7e2433849b541ddd6dcd

  • SHA1

    92b348df912a354fafc6788403bd6dc9f081a923

  • SHA256

    e105a1d7fae4d0cb63d068b328d83d41e07b7b27b2bfdc65b2e47c5dfb90466b

  • SHA512

    abf62809d26fb85561735b2d99e30618458ba2298c5e2de834f0313dee419c2c3c75fabcb517c84914a2b93d624814e32e8c24768b83a710a752d84f9d77d55d

  Score

  10^/10

  bumblebee6rrevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4

• • Target

    parelmo2.dll

  • Size

    1.2MB

  • MD5

    750d8c74c04035cdda0e2e4c8022f0f3

  • SHA1

    eefea7491859a56200b9e5d7d676112039778e3c

  • SHA256

    f3d6cc38e35b0738ac5968f8c15404bbe17a1cc00cd6af03b99942e3d9174c8e

  • SHA512

    9d9e6968c9dfe44ad465b652b6b517b875db8a45490f7e22e1099481e813915f4d921d925ee4d6408dc37423a78c4295e0e3260bfa2aac3ad84edff2edef5586

  Score

  10^/10

  bumblebee6rrevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral5behavioral6