Extracted

• • Target

    ISO/documents.lnk

  • Size

    2KB

  • MD5

    224e06dd94c06af1e883dd7e21ae58ff

  • SHA1

    7a0e842d2c78c8e31d114d7b3f53a678c3f14168

  • SHA256

    f10f7b6b90f1fabd7d55822fa50d11cda7e8651df246daa8f1cf2360cebca61e

  • SHA512

    6d83201c43231c91f0b6ed4efc579c3502bfe5b414320d837f6c9c8df404e8e33c365e69197e6774fcd62b5fed8ee701ee874513afaed9deabbb4bb9f0dbb620

  Score

  10^/10

  bumblebee1406revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    ISO/timi4r.dll

  • Size

    1.7MB

  • MD5

    6b57fa501321b2ac4f67643f3efc389f

  • SHA1

    a4654130534ad4644da52f758b35de784c01913d

  • SHA256

    76e4742d9e7f4fd3a74a98c006dfdce23c2f9434e48809d62772acff169c3549

  • SHA512

    ccbac2fe07f5490226cbd05314af4c93557aca8fd2ea943a1f75cdd6fa94aff94533ab0ef2ad00ca1be9cc4623e4b8025fe56fadf348d8bf8fe2a312b3e34ea6

  • SSDEEP

    24576:FlfKjRXMDFHC/bemHc+X2eiE3WwDFecqDR9:F9+RUHCjem8+GeCwDFecqDR9

  Score

  10^/10

  bumblebee1406revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4