Extracted

• • Target

    9266985ca39ce357d011543b618d868065eafa22e0988f64a831a2745337b93c

  • Size

    1.7MB

  • MD5

    d5e252ef513f49804ed1867091348af4

  • SHA1

    f28b33dcca97748f8c65c5595fa836d6e5d9d374

  • SHA256

    9266985ca39ce357d011543b618d868065eafa22e0988f64a831a2745337b93c

  • SHA512

    1adcfab752d50e33b04a2760a01500399396031ed8c1bddf4c60715909d81b203e613a8a63033f715bc817768290b1becb494e5db22d4a411a9431d2102f4ec4

  Score

  10^/10

  bumblebee166evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2