Extracted

• • Target

    b0df5ebbe715a93804e3313338175ee9d6d4282ae66ab595d00dcfab75adb710

  • Size

    1.7MB

  • MD5

    b70fddecccb484de9bd858ef9d5b4e29

  • SHA1

    8402ae5159d6e507ab0131a865a3181698914156

  • SHA256

    b0df5ebbe715a93804e3313338175ee9d6d4282ae66ab595d00dcfab75adb710

  • SHA512

    24958dde755fd76a67f0b57187d4f45748eeececf0e2fd3a0e85865749b49439a8bb48150f78d838343b7348bc7450dc25ec75ddeb4a5b06130f691105e932eb

  Score

  10^/10

  bumblebee286aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2