Extracted

• • Target

    ScannedDocuments-0622.lnk

  • Size

    1KB

  • MD5

    3241e36fc0c204fd96ef9302a3b11969

  • SHA1

    9add539d4a7982cc426e6852f7223d5ace95549c

  • SHA256

    4c536168dab929de00efea26af786da1282aa2aa2b6809d89eb62ad76404b564

  • SHA512

    0c70f5cd7f64cacc3516162d2ce2832b83e7143a868d1c45eb2b09d1e8150cb125ecda6843f613546e5e27e828ae02bde8d8166da9d8a92934e343a9b493eb5d

  Score

  10^/10

  bumblebee146levasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    inf.bat

  • Size

    41B

  • MD5

    993ea3729ef89775410c1f8a5e4a468f

  • SHA1

    3f5b69eb4d54ee92493f211e13ffb89cda914650

  • SHA256

    1e78385d81b5177c733c7e2ed2f91d5400fd526c786cac089aef6e6f6ec2f08e

  • SHA512

    14564f14807a341b161a753da27af790275e2dd0803c37c294c52d8882962ab0f774775417a80beacef4fb07cc36cc683077622d5851b5733005791a5d3abdff

  Score

  10^/10

  bumblebee146levasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4

• • Target

    information.dll

  • Size

    2.0MB

  • MD5

    c9216484a6371b055705ec5f4098ab01

  • SHA1

    a13903e50408e11996159fba5f7deab1e73e8f08

  • SHA256

    fed9bc8df9141f8f8f7a9203bc26b5b22123c154702fcd625379f2f7ecd31cb2

  • SHA512

    64485bb8e1845a29f9d60343a0bd6fd8de4220aa83f3cd19eed47737642b79db2753106192798d495202e74016f2e845d161c1362ad09b01104f9cfb8c939359

  Score

  10^/10

  bumblebee146levasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral5behavioral6