Extracted

• • Target

    rec/replay.dll

  • Size

    2.0MB

  • MD5

    fc5b7fb7c307677abf16d477e674c3cb

  • SHA1

    28c0bc94ae81e4df179d050d8f353f6b2a7e01ca

  • SHA256

    4fd180dfad7c544ada012af536d34740995027cb1a0b651f9b9fa68b53481756

  • SHA512

    f4742d7b8a8e3fab84fd025cc74780a86e06b22ef70fc8cc54fc9754bf50431dbd471ffd2cdee688f3d8551c80a08b18297a265e39d99aaa23cca8c40078a0be

  Score

  10^/10

  bumblebee146aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    rec/replay.lnk

  • Size

    1KB

  • MD5

    4e543f7a1f8d9c3014623983c74c570f

  • SHA1

    9d71a451a20f5c14fa97ce12f38e64e11576361b

  • SHA256

    c0987d05cb86664e27d0f3cb7ed5142f38935e8ce7754cbe5e4525fdca480cdd

  • SHA512

    c539f4694b59567c33754d92e74e7f56968abe5325efc12aba308f53fd19ea4901164326a003735335418f4ae9539fe9e03e1e54b72827dc9f38dfe463faa58d

  Score

  10^/10

  bumblebee146aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4