General
-
Target
lel.rar
-
Size
969KB
-
Sample
220621-wbfpcabcf2
-
MD5
998c7ee040d297cfb3c33b75a572f0f4
-
SHA1
fd5faa6518458fe5188b65c2afa39fc3a920815b
-
SHA256
2812091cefca5599b7ce8bc45bce1040b0d739a9fc75f83adc27388720ef5d0c
-
SHA512
dc0dd1a84d0595477f1865144c6c5d6ca03937eef005f3c2eea8b3fc925c29615103bb1ce085ccaafe9cead650ed565e3f0d4d4de559991d2a80d381ebe98afd
Malware Config
Extracted
bumblebee
2006r
149.4.32.76:241
194.104.136.152:443
119.230.89.42:407
45.153.241.234:443
173.45.237.73:444
169.239.191.195:335
173.107.248.213:137
90.108.111.212:276
146.19.173.105:443
216.4.65.112:354
52.6.247.44:324
162.212.72.241:135
114.188.145.216:303
5.109.171.105:392
142.11.216.143:443
87.144.64.172:286
103.250.125.252:491
117.173.171.58:296
157.2.47.226:120
53.50.204.254:356
Targets
-
-
Target
lel.bat
-
Size
56B
-
MD5
9f2b2610806e40e0f97f813709748858
-
SHA1
609140b82f50d7f2d47c131cb7375e76e9cf1b61
-
SHA256
f4e987c1ff5611b780a6286b3505f095d0e29c1ff50aea1df4d44556bc6d3b65
-
SHA512
7a4bf3fff43853ac53cd99d6b3cbed1eadc65a593eb427adad87ed59fee5b9d76137029b46cfa8a97303204d1d48053de776a6dabd9fcee74ad9350694cd017c
Score10/10-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-