Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    1d43bbd7301e12a5047c10f1938a4e41

  • SHA1

    5088ef29327d60651678cadc8e00e3cca95c4dfb

  • SHA256

    26f55122d1ab31238ceb46e816717c50dd2aad69a991ef79f5a4824bbe96b921

  • SHA512

    826257ff28350eb645ed68f8fcf87a02d267b2594ee37963478807aeec391a5840977b80719882681eb29183206bc0d5936e92e31fdc4dfc0154b147edcc0570

  Score

  10^/10

  bumblebee2006revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    s3negar.dll

  • Size

    1.6MB

  • MD5

    e96805cad0ee3a8fe51a1f15755d62cc

  • SHA1

    c597e13cb44cebf5401ccb56e92ef64c18128e34

  • SHA256

    262cb83dca4b482b1fb74e10c0eb5e668ba605081d5d42d559e80b864de8c3e3

  • SHA512

    b1c45021f018ccf2a2e100aabb770bfc047388b991d3e4547651ee69ccdf66de6393e668e985b612f552fdc1ba137b636100f9259082c17682844456d149d3bf

  Score

  3^/10
  behavioral3behavioral4