Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    663851b4f1b3ad5acd85c4ab15493e71

  • SHA1

    32060a7f992322ac9bdf6d976d60181111b571d6

  • SHA256

    68e3bf7eec93dfd4394746769532dbc890207fd6f554c18165e8a2746b3fe2d2

  • SHA512

    0d51286f76f3f8fd292574b97803891571e3c20a110e7b830208591f69fab86941708e1751d3851724b0a12f610ba603afb259451c9e480e42fc306d0688e828

  Score

  10^/10

  bumblebee276revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    n3zarek.dll

  • Size

    1.4MB

  • MD5

    b41810bbc67d20adb256a0d30674c881

  • SHA1

    e332e30611b36bbda3ffa98dbdf57590dab5b932

  • SHA256

    924eb7c79148a8dc9cd66ace2702788c172a82ca8744b3283bd030ec0414e80b

  • SHA512

    8a43bfbaa05b4dc1949b7030236ff249d54ead3b50c8ce24960d52f7b13a5903b4c764f59c453f2249ebaddcf65459c9a92b3b7f81304e9506ad5a239b274735

  Score

  3^/10
  behavioral3behavioral4