Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    663851b4f1b3ad5acd85c4ab15493e71

  • SHA1

    32060a7f992322ac9bdf6d976d60181111b571d6

  • SHA256

    68e3bf7eec93dfd4394746769532dbc890207fd6f554c18165e8a2746b3fe2d2

  • SHA512

    0d51286f76f3f8fd292574b97803891571e3c20a110e7b830208591f69fab86941708e1751d3851724b0a12f610ba603afb259451c9e480e42fc306d0688e828

  Score

  10^/10

  bumblebee276revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    n3zarek.dll

  • Size

    1.4MB

  • MD5

    8135745a29f02e96db7b075de3bb7fdb

  • SHA1

    fabafe2e3440dbd71d8d9614a3c8abfb1434eac9

  • SHA256

    90576eb6754dd1c38fb4cea4bf3f029535900436a02caee891c057c01ca84941

  • SHA512

    df5b9c699f5f85d3d666b4cb0d05f49f798a8c3fec93e98fdc0ccc703bc1cabc5752852e1a5f4020fdd9c7a1c48337ff4370b18091e03b6155262e77daafe43d

  Score

  3^/10
  behavioral3behavioral4