Extracted

• • Target

    PRD.lnk

  • Size

    1KB

  • MD5

    ca9df40e1b6f6349a68ef7b1555b209e

  • SHA1

    4f4638fef1f9bc68878fa57f447914678e6fd126

  • SHA256

    c7279842afcbafc33f5e089d48a2b82e91d48e0f76a554e32dc6c99f3aafe49b

  • SHA512

    26fb54dc463b99d5249cfac02f6fb860cf95af9f28d319b40ca838d422392f81121fbcde51cacbc2fe45bcc0e7523661c4962321acdd114ea01f4acba1eaf18c

  Score

  10^/10

  bumblebee306fevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2