Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    9df6df3b98d90c2a892c2120876b6339

  • SHA1

    f1634315324fb3bb1384c4197be3bef0cf447a83

  • SHA256

    c307536aa32637598b607bc03c11daaf50c7adffcae47b22c29c3deb5302d674

  • SHA512

    1499b16b317e7020438cfbc0af7e7345687a2bffacbe6b354ee404ba5f79d659d798df8446569afc05e1c2f43d19d60a9a3423fa7fec4b120dfc989ad804c855

  Score

  10^/10

  bumblebee226revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    m4ros.dll

  • Size

    1.7MB

  • MD5

    380d33a0977b70e018de30269eaa5c4a

  • SHA1

    4e5e74e47d18ef79aa674fe020c6538c4cc17222

  • SHA256

    55907bf7556c33200815f38f1045b94fd7ea2b76059bc4f0de2ad5d1fec13b6f

  • SHA512

    aa26e62ce7ffac720af7aa2a1d40e3aef26f5fd3dd9ead09f4c25d208d397eeec1597d0adfcfcef94ee13338d5fbcbda6ad995e54cdf85a05c7f320120373e10

  Score

  3^/10
  behavioral3behavioral4