General
-
Target
file.zip
-
Size
938KB
-
Sample
220624-s44ebsdchj
-
MD5
ef7d72dc8902f578128dd9bac5e1a3f3
-
SHA1
6402ce9ed3e9c7a20e0e91f396321733fefa0834
-
SHA256
46ad48137ac8f8fae753f6072888d355a38556a9372b82599cba23b803eead32
-
SHA512
406d7a2ec34b7da072e85aec4433f8b9bb6dbddcc4a06de6a7968646914add0a3e98d77f7b9947e0d1e27174fddb05f442375c7df71ef1f835def4990761a936
Malware Config
Extracted
bumblebee
236r
54.38.136.111:443
103.200.32.188:492
74.57.128.223:112
13.2.200.200:338
228.194.82.251:473
247.224.208.140:372
0.151.228.146:282
192.119.77.241:443
186.150.217.235:221
50.41.225.93:478
50.167.186.112:239
173.77.219.120:201
187.210.45.242:299
239.11.133.48:421
207.6.99.3:471
98.28.11.39:201
193.239.152.108:242
133.209.39.126:217
146.19.173.202:443
97.194.155.116:446
Targets
-
-
Target
run.bat
-
Size
50B
-
MD5
c4fa41e7d1ed643cb7f3258b377fb164
-
SHA1
58e0cc9409fc00365b1f4cf212e63f3acbfa3f10
-
SHA256
19595435b3bff0250da79c1fd62711aafbce71ea85eb4ad91b41817368e69d35
-
SHA512
f30e59baf05aa35852aab853c06299b66c50e656c8faa4d627558ee0ec78a9068577456d394d9c19062868a88fce34655b0ac2f7446f125e727106723eefa68c
Score10/10-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-