Extracted

• • Target

    m3n4rat/documents.lnk

  • Size

    2KB

  • MD5

    1e3f5cd9d257761d411f55b1c28c6e50

  • SHA1

    104ac15abdaa5313dc243c7086781339223b55fc

  • SHA256

    79c46064eb48f99845aeac03b836df35fc034fe8fb603a5394cd58932811d418

  • SHA512

    1a5ba3732118c9aa758d80cba57a39feaaf9af5ecbc232463347e41ff286d94cd74fbd4f05747c08023d4c13f38f433728ebd3c08d2a60032f8c65676d45f217

  Score

  10^/10

  bumblebee236revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    m3n4rat/m3n4rat.dll

  • Size

    1.8MB

  • MD5

    4b71fc8e3a2849d9fe51cba2d358b1bb

  • SHA1

    1f3c1c27daba5670476e93055fc2a15e05b43c16

  • SHA256

    ab2bd1f1f033acabd85b1d30218dcb1824a1c151a41ead3f876c11930f6306db

  • SHA512

    894f0a0b21ea145f48bb3313376829b74205d4eac5ab2a07d33dfe0121a68f527ca880b7c0fe7b46e4abe460921963c73badde462dc80211c9f8af15559dd1bd

  Score

  3^/10
  behavioral3behavioral4