Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    2207b8077e12e9b9e4b99472223ef4a5

  • SHA1

    8ec827a0eae5b9f604fac9df1b0a771d9f7801da

  • SHA256

    f7d28026d41bf2a098bbf592d5ce2ed4f31fcc47a453ecab4e241910e3f407b1

  • SHA512

    b06ef3c5a2bcf29450f32dba9208c2326b2d350a5b317be9fe1607d80dfbec35c326e3a9968e6346085988a88ef328431dfdf7ef4eb8a0f92c5b8c9d08909121

  Score

  10^/10

  bumblebee1406revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    timi4r.dll

  • Size

    1.7MB

  • MD5

    c2431e5037bdcbc7573520ea8c99ff87

  • SHA1

    8a4f5bcb62f7eb290fd4c903eb15ff58be9f5aa5

  • SHA256

    6aa4da1ac218390e6cb97bcc7c5483ab4815c5e5b075ea86da8f123d25e9832d

  • SHA512

    46452afb80f78f8a7b4c120cac8071e4e7e5e13f03663901c901aa20f7df4a1091ad2f55970087e5c3151115df206e0e09764655d22671535973b1eb2395c7fa

  Score

  10^/10

  bumblebee1406revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4