Extracted

• • Target

    timi4r.dll

  • Size

    1.7MB

  • MD5

    6b57fa501321b2ac4f67643f3efc389f

  • SHA1

    a4654130534ad4644da52f758b35de784c01913d

  • SHA256

    76e4742d9e7f4fd3a74a98c006dfdce23c2f9434e48809d62772acff169c3549

  • SHA512

    ccbac2fe07f5490226cbd05314af4c93557aca8fd2ea943a1f75cdd6fa94aff94533ab0ef2ad00ca1be9cc4623e4b8025fe56fadf348d8bf8fe2a312b3e34ea6

  • SSDEEP

    24576:FlfKjRXMDFHC/bemHc+X2eiE3WwDFecqDR9:F9+RUHCjem8+GeCwDFecqDR9

  Score

  10^/10

  bumblebee1406revasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2