Extracted

• • Target

    07m2se/documents.lnk

  • Size

    2KB

  • MD5

    516c04aa962dfa0e35e7c992c0eb88a9

  • SHA1

    0ebc08f00d9eb38a72b43be9809162d3362a35de

  • SHA256

    a7885b210054b39cb48f1f95a6697480dfa5f81f5439b69b493ae36a0266d1df

  • SHA512

    92a0fa2f6c7dab55bf60079b33a00dd96aabc19a4a391bfc458a696da62e78035e251f7856a2f4c5665db115305f0aef97c5ab4fd4571c96a147b79fc370e1fe

  Score

  10^/10

  bumblebee507revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    07m2se/o7m2se.dll

  • Size

    1.5MB

  • MD5

    aa24e9ee74b1ad6d41c59dbf31d7f710

  • SHA1

    41a51bf7fa95bc229a9f6fa6a6d91a05404c996b

  • SHA256

    c6b2d8db11137aa172cacfba7e63f05664a9888b97b72082d0da1f7eaecd8468

  • SHA512

    7271b898af8c50aec37fd5fcd0f0e73cddae480a86cb3110b6411217c67b33346cc527cfa0cdb72a6f7a9ef838b347b5d2f4cbd917ad9762cdcf44e0e18f01d6

  Score

  3^/10
  behavioral3behavioral4