Extracted

• • Target

    ae55a2fd04b046681718c4c0c527faaa4f951980cd8d619ab512a98a32d61c85

  • Size

    2.0MB

  • MD5

    b38e751e7101c3cc163c6fd77fda959f

  • SHA1

    ef125f6a233f7036157d38a02ad09de8226adc13

  • SHA256

    ae55a2fd04b046681718c4c0c527faaa4f951980cd8d619ab512a98a32d61c85

  • SHA512

    8c0d7434419e07d27d772239ae2c32bd95ad57979e10a8bd7808f1f21215b42ff9497c430127a8b3ec77f9544f9a11a078c1af45776fea1d69775625928c0819

  Score

  10^/10

  bumblebee707aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2