Extracted

• • Target

    invo/documents.lnk

  • Size

    2KB

  • MD5

    663851b4f1b3ad5acd85c4ab15493e71

  • SHA1

    32060a7f992322ac9bdf6d976d60181111b571d6

  • SHA256

    68e3bf7eec93dfd4394746769532dbc890207fd6f554c18165e8a2746b3fe2d2

  • SHA512

    0d51286f76f3f8fd292574b97803891571e3c20a110e7b830208591f69fab86941708e1751d3851724b0a12f610ba603afb259451c9e480e42fc306d0688e828

  Score

  10^/10

  bumblebee276revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    invo/n3zarek.dll

  • Size

    1.4MB

  • MD5

    3bd955af74d15e226fd00c7c8556858d

  • SHA1

    8bd4d50e485813c5578b59d5e12658e739a9b818

  • SHA256

    c8902ab26a64078ebab618afe410edc41c3d9c6b429a7d84207f112d740cfc51

  • SHA512

    8c47d5360324fba49da30384ee05a34ae1abea772c34ec8fa3d5db2793b39d6aa25e59f1551a72a9cafd931d401ab143f618accdd460bd707d9c09f81f52f758

  Score

  3^/10
  behavioral3behavioral4