Extracted

• • Target

    18aed3582da2419ab339bff7d1e84b1eac88d5c9bfaf7320daafcfbb6f6798b3

  • Size

    1.8MB

  • MD5

    ce8aa596ab8c1d075439a9ee29a438c6

  • SHA1

    415ad86787a40abb95fb67e604aba8a075a41ead

  • SHA256

    18aed3582da2419ab339bff7d1e84b1eac88d5c9bfaf7320daafcfbb6f6798b3

  • SHA512

    a5c7d3b9d127bc1ab22a8a8596a6853ae721fb3286e0b3d5d6592d9be603f1ec31055b7598aad4c9e5ee8adb351a122f12605aa4d76a3842ace8f01645f7af1c

  Score

  10^/10

  bumblebee166aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2