Extracted

• • Target

    000/documents.lnk

  • Size

    2KB

  • MD5

    516c04aa962dfa0e35e7c992c0eb88a9

  • SHA1

    0ebc08f00d9eb38a72b43be9809162d3362a35de

  • SHA256

    a7885b210054b39cb48f1f95a6697480dfa5f81f5439b69b493ae36a0266d1df

  • SHA512

    92a0fa2f6c7dab55bf60079b33a00dd96aabc19a4a391bfc458a696da62e78035e251f7856a2f4c5665db115305f0aef97c5ab4fd4571c96a147b79fc370e1fe

  Score

  10^/10

  bumblebee507revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    000/o7m2se.dll

  • Size

    1.5MB

  • MD5

    d35823ecb2ecf107fda8ad5f70bf34c6

  • SHA1

    e2f168167206830a98d4897fcba3a1973118979b

  • SHA256

    d39a9ee4ea88ff2189fd57ec1d26ded5f91c3545663ef12402abecdb10ee5b06

  • SHA512

    c8d7759f7aba1e9ae7212f937fe7abf99b5422a19231d7e9037d4cb3ad5648d1ec622e7fc090f598e4a2ae3c2f2d1ec33b598ad9265764e3ac3273550e52a99b

  Score

  3^/10
  behavioral3behavioral4