Extracted

• • Target

    docum.bat

  • Size

    39B

  • MD5

    9b2244d9b15b1186430e2feedf1a1cbc

  • SHA1

    e42ce05798212df517d36cec81435ffb1877c3fd

  • SHA256

    f17420ec26a57d29eefd782b046a8c7be41bc1da1d9bf08313e6fc83ccca333e

  • SHA512

    d0cf589d6d31fa45fa7982e3d817920a4dbd06771f2051c0a3d4e4da92d43f4787e73d666351f473684d1db16e0c04909f1b52e87da1eabc87d6d76e5b24d387

  Score

  10^/10

  bumblebee6rrevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    690b95081eb2c3eab4f10f027cb2aca8

  • SHA1

    b5c7a3e0190126a5c738a39f60e81705b8fd1e7b

  • SHA256

    10f2cdf35e577ec35e2ac8e1f6a36d97a5dbcf8298dd430bd9777bfb9a9564dd

  • SHA512

    2b7262f82c93d5ab6e32fb5e711e015a60a2e70366321c53d7434300e6e7bc248634ccdad2619cf8c4077b6b39ce5dca6a3c226a06aa647a71dbfbf781428397

  Score

  10^/10

  bumblebee6rrevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4

• • Target

    parelmo2.dll

  • Size

    1.2MB

  • MD5

    750d8c74c04035cdda0e2e4c8022f0f3

  • SHA1

    eefea7491859a56200b9e5d7d676112039778e3c

  • SHA256

    f3d6cc38e35b0738ac5968f8c15404bbe17a1cc00cd6af03b99942e3d9174c8e

  • SHA512

    9d9e6968c9dfe44ad465b652b6b517b875db8a45490f7e22e1099481e813915f4d921d925ee4d6408dc37423a78c4295e0e3260bfa2aac3ad84edff2edef5586

  Score

  10^/10

  bumblebee6rrevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral5behavioral6