Extracted

• • Target

    documents.lnk

  • Size

    2KB

  • MD5

    516c04aa962dfa0e35e7c992c0eb88a9

  • SHA1

    0ebc08f00d9eb38a72b43be9809162d3362a35de

  • SHA256

    a7885b210054b39cb48f1f95a6697480dfa5f81f5439b69b493ae36a0266d1df

  • SHA512

    92a0fa2f6c7dab55bf60079b33a00dd96aabc19a4a391bfc458a696da62e78035e251f7856a2f4c5665db115305f0aef97c5ab4fd4571c96a147b79fc370e1fe

  Score

  10^/10

  bumblebee507revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    o7m2se.dll

  • Size

    1.5MB

  • MD5

    53e39a08c5136787aecaf107f9e0c259

  • SHA1

    2a64185b5fa2a0e5c30974b4624c31e668f8fadd

  • SHA256

    e2a4f0f0954cf69f16c7672f6415f80c78492602bb82dc5009b4efde81521d48

  • SHA512

    642493d839fd9a147c6d02a907cc2b898ffb91c1415359f22f8b1698dce6daa82fa23a26f5d099b837f11185dedafaa12c96e1e9fc5eff9d86a8a6917fa9c638

  Score

  3^/10
  behavioral3behavioral4