Extracted

• • Target

    glin3r/documents.lnk

  • Size

    2KB

  • MD5

    0c61c063804dbbe46b16acbfb28d8771

  • SHA1

    1231e3cddeedc09bb243b9b4536f3029efc4c8b7

  • SHA256

    7b9a00cbd523a9585abb072f782b0b1447a905a3d63232627591bdf363f776c4

  • SHA512

    6c2a29ba06bda9b778e2590d45ba698bc7b195c014afd31ede17ce086786413b97d8c9c7f29b38e07022571e0a397d44cad01550fb5a673014246c21a350e35b

  Score

  10^/10

  bumblebee156revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    glin3r/glin3r.dll

  • Size

    1.5MB

  • MD5

    f5ce1054c971dc73f2c5ea5395147145

  • SHA1

    064359e7f83119cde898819c7197d3aee0d0013c

  • SHA256

    69528c51e24fec01328da497e2af91379dd09720a36c673f9d0cd568ec6baa03

  • SHA512

    557970a18426487f209fbe72d2c752fe952f6099fdaa750cc6c90c41792adfa40aba236d41d0bffae066cd990a4c98e4aa5f40a2fd0be6e26a0585cffda6f261

  Score

  10^/10

  bumblebee156revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4