Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    663851b4f1b3ad5acd85c4ab15493e71

  • SHA1

    32060a7f992322ac9bdf6d976d60181111b571d6

  • SHA256

    68e3bf7eec93dfd4394746769532dbc890207fd6f554c18165e8a2746b3fe2d2

  • SHA512

    0d51286f76f3f8fd292574b97803891571e3c20a110e7b830208591f69fab86941708e1751d3851724b0a12f610ba603afb259451c9e480e42fc306d0688e828

  Score

  10^/10

  bumblebee276revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    n3zarek.dll

  • Size

    1.4MB

  • MD5

    98a63f31289d5b8106140da1d3fc2f60

  • SHA1

    f479133350af108ed30e633067467df6f17a4fda

  • SHA256

    c536f15022bc8cc16dede9cbd855008ed6c80908245e129425662948014d90c1

  • SHA512

    bfe86795b6838cfe4c596d5dda9c7429a85ed61b43580d5b0137c3cdb508b8a1da386da8487907fdd003cda259029b98bdd97563ce2e4a4075fb333eb63ae2ad

  Score

  3^/10
  behavioral3behavioral4