Extracted

• • Target

    toso3l.dll

  • Size

    1.7MB

  • MD5

    d6a09a35b18a25b756fd0a2cfe18ecf1

  • SHA1

    d14985b445752dbd84698ea9132d597aecf495c7

  • SHA256

    47a9ee143d413413a5f92a39d07c02dcd93f379387b1b6a0d26ed978a2c6425c

  • SHA512

    f438c7adcec7f691b86c90156ef9816df69cb94323fe0c3ebb502f98d8ce4c6ed0878dcf666a7b56f96f36b5727ed3521cb2d237aecfed02db051c2973d6361b

  Score

  10^/10

  bumblebee1406revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2