Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    0c61c063804dbbe46b16acbfb28d8771

  • SHA1

    1231e3cddeedc09bb243b9b4536f3029efc4c8b7

  • SHA256

    7b9a00cbd523a9585abb072f782b0b1447a905a3d63232627591bdf363f776c4

  • SHA512

    6c2a29ba06bda9b778e2590d45ba698bc7b195c014afd31ede17ce086786413b97d8c9c7f29b38e07022571e0a397d44cad01550fb5a673014246c21a350e35b

  Score

  10^/10

  bumblebee156revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    glin3r.dll

  • Size

    1.5MB

  • MD5

    dfcee862a58ab04a5fcb9417d81f7084

  • SHA1

    4fe82f38d826dda103dce02380ad859387d92578

  • SHA256

    46edbc79fb5779ff1ed0c35641bfda0ceb25782c262c54ce77e94ad7676f727a

  • SHA512

    b01a706d684de75aa35a12b47fa004c86293c673d6df80cc2d7da6df348f55c191dc8d1cb3653b66e113534983d2604164eda0c18529f705bd762b0f6bae3da5

  Score

  10^/10

  bumblebee156revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4