Extracted

• • Target

    document.dll

  • Size

    1.4MB

  • MD5

    e50e41bf9a093738ee06b5955db11ca2

  • SHA1

    ac2d1d81c7e1e3f242a0cbd3b552cdf5a6ac075f

  • SHA256

    a3c7ed64da6b0a3929ffb607d2ca9216ddd99e591b1c3dc911605631cc378fe9

  • SHA512

    2c22fa61fe8a7d66a0a5a7fc428ffe264db028a749b29c77529c74927c4e4d81813039f7f8f3ae706300683dc5fc724bc4a9a5e4eb3cf1fe922ebf00606b3449

  Score

  10^/10

  bumblebee306fevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2