Extracted

• • Target

    project requirements.lnk

  • Size

    1KB

  • MD5

    db4e4a4e926e4dfe525929250afe7ae7

  • SHA1

    4eb0bb7294c53f896527ce770e3c299c2fcbfdca

  • SHA256

    7c38f9a113c85027806676885e027e4ed7de6b3c9bbd0861babfc2a8c911ec48

  • SHA512

    f75a3e9b0bb22c9335bbd38bda8858ec6d7f11dd66c0bd26d45be4d9c0c4f49b9f559e5ed4be9da7a9f9e77f920c0aebb27ae60876a26635987ba504b997a538

  Score

  10^/10

  bumblebee156aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    project.dat

  • Size

    1.5MB

  • MD5

    fb30fa42b6fb4cbbbc3f597cc782e56a

  • SHA1

    f0c5391dc040286cac62d5900ddc20c178da0839

  • SHA256

    7935ad8c2dc8d082530650b858d1a2f53f4990a376ca84e3c29ce7ae5bec94dc

  • SHA512

    03171c8e689042be587b98533dd8c737331ca4357ded0774db6e8a6feda2de2dd8c9f6f66b300080425756bba1bf77fcb361ea8ffbba9b2a2e5f687b224ac60d

  Score

  10^/10

  bumblebee156aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4

• • Target

    project.rsp

  • Size

    18B

  • MD5

    06c6c9e9f69b6ba4bea7dd172904ee74

  • SHA1

    4e86f1b41630dbf43be2bc82e516317c166aef8f

  • SHA256

    3b41f2bb928cb4ae75944da01bf3204dd7fda3f80ae1b800395656b70b53a4ab

  • SHA512

    e5bfffa1cda707667f4ea389775badb69bf4542e243b0489d042d2a3b5c1eeed8ad098f240ddc029a4f7ebe837ca3bcd5532cf2fa0434477d5dc5245d1adb8f9

  Score

  3^/10
  behavioral5behavioral6