Extracted

• • Target

    PRD.lnk

  • Size

    1KB

  • MD5

    1a9b5960c26658ffa3424a6810ee86a0

  • SHA1

    391b80628d2402518693d457ff863c1091475c03

  • SHA256

    0250c86129cd0bddd7094f5ea76377d5f30bb8ef039499424570ab568e7e7312

  • SHA512

    1c065fc862cccec778ced1343a29ef792b3ca39fb69f1cb28bab4c5deb10b9d77dd2aa9a5ef2acadb85a9886522a2bcbecb31f4fa981c3d260b3a2308579bbf3

  Score

  10^/10

  bumblebee236aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    projectr.dll

  • Size

    1.8MB

  • MD5

    546d975e638d044bc23c7f1bf4122d26

  • SHA1

    2efd0d398b648d5c70db7d15b1893eb19519ae74

  • SHA256

    287055194e83ab2a8d91ef4d187de57345c19018cf3a85024c4fd20c64ad689e

  • SHA512

    7e4709e4dd18965966466334870488b4469e9920c5ae5bbc8bbd2249d2071744ba9c3d169be5d1d9280555465fc8659df4e7059a67f5ceca7f76dc8aa388a610

  Score

  10^/10

  bumblebee236aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4

• • Target

    projectr.rsp

  • Size

    19B

  • MD5

    96dc58c3dc67a1bbea87e350f07dcd54

  • SHA1

    be9cce20ca83a96acd39f9af4a620c264515734a

  • SHA256

    fc394b8bf75b4279f2752d3dcdd17d56cb00ef7714063f18915b75ae49e54eda

  • SHA512

    ef6bab70d8b3ff1f8ceae592884a516fcdf90028881ad1ce56485ffc4d215fa85df874b16367567b8db5fcd5ae845dddbec6d310f809963e3e0290970b8b9931

  Score

  3^/10
  behavioral5behavioral6