Extracted

• • Target

    PRD.lnk

  • Size

    1KB

  • MD5

    ba087f3dc565e4c1dc54c5e2f581f4a1

  • SHA1

    90940bfa9973a4d455e25d09c2c0f1c4d2ffb06e

  • SHA256

    dfc5072b4874706e6ebe8c47140dedc6051f8dda92351bdea8996154e6a96ed2

  • SHA512

    c3f22c3d24d08b4fe96e097bbb192f1c47afc3933b49d20da98d33edd0fb8c6c7615a102a4f75d6f1ef50c0c85ab574e9b41be9adf780ee27b6667b3e64d648c

  Score

  10^/10

  bumblebee286aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    sec.dll

  • Size

    1.7MB

  • MD5

    a30bf883c38b54c3b22a2f8ccfb1bd8a

  • SHA1

    9a5ec009753040c5214b864d9d271901eb4542ac

  • SHA256

    95a6114c8b9879ebc9a0142fcd46d41dd428380a27d5b396a232f42e4a505fb2

  • SHA512

    64d3f30c8564e4eedecd7f3f8c3b1eafaa3d781fb5bef39825ea1b8fdd1f39c38ac477f08a7a147fcb2f404c32ded7ae841b5bb443070945e1aa60668838ed58

  Score

  10^/10

  bumblebee286aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4

• • Target

    sec.rsp

  • Size

    14B

  • MD5

    178205c1d8cc39f1e6a76bf86d791dc8

  • SHA1

    215b7894b9680f604802b65381c58848ef3f17f5

  • SHA256

    0f1419dcae5228bbe4f9305d5b265478ef5c618adc41540a637e08eb25f66429

  • SHA512

    1dc4edb8c1467d5de639d9f5afaee1bec19edfab83f6d307cdbcb3870c22276029c92f06cb2bdefa1dab04c6f9009e5cc998cc009b68707ec92e59cd311eda78

  Score

  3^/10
  behavioral5behavioral6