Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    516c04aa962dfa0e35e7c992c0eb88a9

  • SHA1

    0ebc08f00d9eb38a72b43be9809162d3362a35de

  • SHA256

    a7885b210054b39cb48f1f95a6697480dfa5f81f5439b69b493ae36a0266d1df

  • SHA512

    92a0fa2f6c7dab55bf60079b33a00dd96aabc19a4a391bfc458a696da62e78035e251f7856a2f4c5665db115305f0aef97c5ab4fd4571c96a147b79fc370e1fe

  Score

  10^/10

  bumblebee507revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    o7m2se.dll

  • Size

    1.5MB

  • MD5

    d808582a5e6f1552c7c9b73a78d85730

  • SHA1

    fa43018b94a710ae297ababf973d7bcfc241fbb2

  • SHA256

    b7668bc3a19d39e11ca96e22acc77b4ab5ebb8aeac59235299c6008959129929

  • SHA512

    f0e2d1ecd9e287cdd1f6b846d08adc129ed301612f174c09b31d984fcea3912daa9d65f8497e6a0e289869bb634359d5e8cb01455566aca3234682c7f968792b

  Score

  3^/10
  behavioral3behavioral4