Extracted

• • Target

    arch.dll

  • Size

    1.9MB

  • MD5

    16da4284ab7ab9d5669c34c339132ed6

  • SHA1

    34dc625fc243d06cbc33d403ac7ee05edfd32819

  • SHA256

    1249075a0c4af8ecfeb4a3ab1e9ef692cb8876591d73f3470106402ab1592717

  • SHA512

    b4bbbb6467a7602b5b2789a66ca343f3706fe1e15a13e639951adaa9a06b8cd97ba6ee6f05340dea679306b22fa7de02ab45b532f1e0de0abd429a9982b68923

  Score

  10^/10

  bumblebee2lg5evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1