Extracted

• • Target

    document.iso

  • Size

    3.1MB

  • MD5

    8b76eb981cb9a08767a93f1c3bdbf3df

  • SHA1

    4d558beaaa7af0e1232fe8d5436f7be0dd674660

  • SHA256

    23c10f0ff64c3161ac221e9cd6eae744b3260f0ac346cca4cc7afa770b60c0da

  • SHA512

    4ea530db2356f434bc7f879926d8ee7a0f4515fa203d576ae7141d7d18477510a7e84049f5aabb350ee10c8315bb9a4cba6e61eee578ddbb553cb37386b13955

  Score

  10^/10

  bumblebee1406rdiscoveryevasionpersistencetrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Registers COM server for autorun

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2