Extracted

• • Target

    90ef9d1cd49e1e7d3244db587e208d14c89d209fda9df1ee9123bdf1225ffd8c.iso

  • Size

    2.9MB

  • MD5

    17eabf73c5ab8530e426596f14a500e5

  • SHA1

    d135c0e39deafa18b0b9654cb5e879e1333e4052

  • SHA256

    90ef9d1cd49e1e7d3244db587e208d14c89d209fda9df1ee9123bdf1225ffd8c

  • SHA512

    e22f4e45ace405fa091ac2abb99369fd5522d715be3d82739df3aec7b91c28f5cda63307057b1a46be724dfedf56d5ca0c4ae84f9310fff29c8392e98279598c

  Score

  10^/10

  bumblebee156rdiscoveryevasionpersistencetrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Registers COM server for autorun

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1