Extracted

• • Target

    54bed834c04ae9d6971b63eab0342bf39cf0c4454c7519cfc6861638ca6090bd

  • Size

    1.8MB

  • MD5

    0c96812e195ff482bf9679fe348b3428

  • SHA1

    7c39f792665a5b0619c97415f1080a10b89d9f80

  • SHA256

    54bed834c04ae9d6971b63eab0342bf39cf0c4454c7519cfc6861638ca6090bd

  • SHA512

    ac0b32d21d3c2fde8f16ba5080a6992bbd264a62fb31535f971502276114f18d41f2c668cc7f6de00946c1720fd4ea0aa268cb4cf221ba2e22c049f319f8bc39

  Score

  10^/10

  bumblebee166aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2