Extracted

• • Target

    document.dll

  • Size

    1.4MB

  • MD5

    75052460162c6183646c2471656325e5

  • SHA1

    0db5117a473a73e328557f5820eac40e7a154edc

  • SHA256

    ea8e3b006b33d1a850a24ace898bef873902cbbd8911305f63ebd3cdeb4aff36

  • SHA512

    a53795f21bd273a5b2ccd2edf047f546352ff7cb9413a6044d3752c4b83ecbab8e53da45449e24d5cfa08319d70eb2beae82026d767b4eb336f4cb474db60724

  Score

  10^/10

  bumblebee306fevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2