Extracted

• • Target

    document_invoice_0706-488.iso

  • Size

    2.9MB

  • MD5

    e67c33a21267bbdabc7da8a26dba9b43

  • SHA1

    0c611820e514c3408744785e16703e987bcdcdfc

  • SHA256

    26f9526506e03ed55f7273a962ed90af8ce429242bcdf10380b638f47921b1e9

  • SHA512

    22f7a1c3c0036c1c924a679630b645c402022953d4060947d5b87f0cbbd89fdac9239ee66267597d84f62dd42e76ea7edf3fc4e27e94626afddef63037aa6ec0

  Score

  10^/10

  bumblebee507rdiscoveryevasionpersistencetrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Registers COM server for autorun

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2