Extracted

• • Target

    loader.bat

  • Size

    55B

  • MD5

    7570714d0f7f867da3c26839c45842fd

  • SHA1

    4d72ffc8ad5aa71c100f732da6eebd5d6e237414

  • SHA256

    b3cb8e9bd42228a54aebd27f2f1435cb2643f698ab805aac64b691f0c0cdf5a6

  • SHA512

    24396fa0e43cd8d5efa1c555905aae9ef1d7041d5aaf00e255d71ebbfc7dcaa72172c455148a2cefecfc52c1978ef782ce011473f4d837ae7a30f2c95880a613

  Score

  10^/10

  bumblebee276revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    n3zarek.dll

  • Size

    1.4MB

  • MD5

    08c3517c5ede72888fbc6f3763ba3066

  • SHA1

    b9cf2513cd5606927032253a06592412ce8a801e

  • SHA256

    690877449ad40cac88e0262df350ab3aa9c33fb788a6d8462003530af61e7ec5

  • SHA512

    7c913d5224aa3ddc798941795f7b53612be8b776190bec0f6bde6c4f9db34c0c5d5a0cf662e0f216150bd8810dd01ac57c0125019f4185499181e07802d16e90

  Score

  3^/10
  behavioral3behavioral4