Extracted

• • Target

    nev3erl.bin

  • Size

    1.5MB

  • MD5

    b2f7a41d9cd91487b53e4c53d5814ead

  • SHA1

    ecde51a37f8f61b4afc7ef5c7ea0c4fd965ca079

  • SHA256

    aa51cae27b9fb466ee5975014e621a7f75babc766d6d5311bfd1be3c6d92c657

  • SHA512

    447057e4a90b70e93f4600015d5d6b8a141ab641cf9670fe66d9915994bd9e7eff40938703199a7dbfe594c2ee41e7752db65b5ffa5bce7f7e8bb89128441bbe

  Score

  10^/10

  bumblebee156revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2