Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    956d949aea33054cc315c13c2f31092c

  • SHA1

    4c37e4e5e8a6d04cd593a66e5be5e289440a612f

  • SHA256

    c23fff6940d9b97ac9dce943bef6e9066291981ffe0f2c1b3f4fbc345203a857

  • SHA512

    56eb41c38d626445143620f6e3dcfec59b7c7b6532d57685cee0651e0887c2b092d9d5310afc3d630819d69e2e49ca66ede38034f26e1097a2bd6d873aec8271

  Score

  10^/10

  bumblebee2006revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    s3negar.dll

  • Size

    1.6MB

  • MD5

    5ffb7b6b8fd8998a33f9c56a07e5c097

  • SHA1

    2b00d9bd48d025fdbfea9f2957e964f15ffaa1f4

  • SHA256

    983ff2cfee5f4d8489f04a955148148d5060c64a2673acb538a8fc2d29fe7c13

  • SHA512

    ebbaf344d91189e64c8b60466f3fc795556ad645ebefdb4f71e294926507bfea4ee8db5e2ec65c9068660cdd24256411c0af8bea8cc1845dbb389b22b0f851c2

  Score

  3^/10
  behavioral3behavioral4