Extracted

• • Target

    Project requirements.lnk

  • Size

    1KB

  • MD5

    6ca6a8b1a8d781bc91444dc2402d3f58

  • SHA1

    a66015ece818c3c35d0ae8a400ee9c102425186b

  • SHA256

    3926bec362d86edc8fcc4e283d6b93b21108d6b9d194de9fc1108df2944b0319

  • SHA512

    f778da9c3762ceb37b65c6ba6864e6158e44a99eb776108825c02b4bb56dc309ec4998eb66b053cff99984294f49365b6a50bf8e83e07ec58782a80fbdf5b2a9

  Score

  10^/10

  bumblebee407aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    prjct.dll

  • Size

    1.5MB

  • MD5

    dd9751f48c134f502d5a7a5b39b482be

  • SHA1

    d7ecfa85e28318bd0179d321be7d32c468fc9dae

  • SHA256

    cbef35e0d91b5f169a3bd617c9ebcb3ea025439cb98e3d4a7dbeed4be65b6ef2

  • SHA512

    381889e149f2b49a50f312c47e1e42cefd7bb5eb79013b2ff3213b5161160015f7f75d6b3d4d4f9b07a303599e904433a271fdcada8255e7deb229e8ad6dc6b9

  Score

  10^/10

  bumblebee407aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral3behavioral4

• • Target

    prjct.rsp

  • Size

    16B

  • MD5

    4080b43f784d55b529bfdaa037f50789

  • SHA1

    9bcde1ef9a7e3fb602572562ca11c24ae64010c6

  • SHA256

    9d7cefe910724cecaefe05a417129eaf537cab95d198cc5b1f0a1d822e810988

  • SHA512

    fd5a879707c13e4a0c324495f332a8277754f2c9af8b6470b976dd7a5a81858047035071e1c7abf4408729817afb6b91092b15b3297252fab04f6fd594ae35b0

  Score

  3^/10
  behavioral5behavioral6