Extracted

• • Target

    s3negar/documents.lnk

  • Size

    2KB

  • MD5

    1d43bbd7301e12a5047c10f1938a4e41

  • SHA1

    5088ef29327d60651678cadc8e00e3cca95c4dfb

  • SHA256

    26f55122d1ab31238ceb46e816717c50dd2aad69a991ef79f5a4824bbe96b921

  • SHA512

    826257ff28350eb645ed68f8fcf87a02d267b2594ee37963478807aeec391a5840977b80719882681eb29183206bc0d5936e92e31fdc4dfc0154b147edcc0570

  Score

  10^/10

  bumblebee2006revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    s3negar/s3negar.dll

  • Size

    1.6MB

  • MD5

    83f07110df33b070ebe99613a1acda4c

  • SHA1

    c97c747f3cb228ba3b00c0359fea2236070cb910

  • SHA256

    7173bf751a2bf8fb237a7cde943ddedd4e89a2b15b571899c84fbaa87c233e8f

  • SHA512

    0ff98beb21c391a54417b688cc38cdf38374af8ca3b27034a478c307f9f83699cc28babd326965349ee81d722aa341e63dca2157da341f8bceb7b29b69fd6224

  Score

  3^/10
  behavioral3behavioral4