Extracted

• • Target

    037ae9d6d426d941891dd738f8bc499c93a5429efcfa261ef2755aed550d2d7c

  • Size

    1.3MB

  • MD5

    e0f372f1c60780342de156d1255402bc

  • SHA1

    3f8b9792bd430ee579d798fa5ab6b5854d22b2ab

  • SHA256

    037ae9d6d426d941891dd738f8bc499c93a5429efcfa261ef2755aed550d2d7c

  • SHA512

    abb3789e02e66d169439252aaeeade8eaea1ec1e7955a2b3fe929bed525ca1d43e7c44f8a59f3c4388cffd68f04950861c23d325b964c72d3227fa5e7bb0f188

  Score

  10^/10

  bumblebee246aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2