Extracted

• • Target

    78c5d780b2ca553cbd3fb0140813e0e1fb7c48491090df605f03c309d0086baf.exe

  • Size

    1.7MB

  • MD5

    fab844f64a60f24b27097d3b7b93cc11

  • SHA1

    668e08011689b809bc231a6bc31ddd6ea576942d

  • SHA256

    78c5d780b2ca553cbd3fb0140813e0e1fb7c48491090df605f03c309d0086baf

  • SHA512

    c9a23c502462438a9d3ba14036d332d51074a838d28968e48fa2711b9d53897b052efe6787576bfd4e4ccb8e43e5e13fd9fa7feb46e915a7d8c79060e8d38a1e

  Score

  10^/10

  bumblebee1406revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2