Extracted

• • Target

    request/JwiggegecGrAtB.dll

  • Size

    1.4MB

  • MD5

    0452d7a9495c0d52cca77823d7ed038a

  • SHA1

    10b2622cff8169d8925af69cb82e92741be4fa1c

  • SHA256

    d61a8789efb9ce1d88d747e25b35bde938f7b749190470a29ec94334fca17259

  • SHA512

    fb71ae9fb2a940d6c8226702475764118c3d6229e7d8501785c42d2cd99afca3b63928f7cdcab0ba626af2e4095b1f7cffa3fe4cb998649b036224fef83150b0

  • SSDEEP

    24576:uYdzZyfNddAr0UjQ3YTF++P8rebQacJ0RVxPiW3IW/Hk0wGaW:uYNEfNYrZjAaF++dY0X6mIWfkHGa

  Score

  10^/10

  bumblebee2908evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    request/request.lnk

  • Size

    1KB

  • MD5

    1cfeaa2c13c3f59448c13fd001716e00

  • SHA1

    bd4c7d8eb86b76acfc15943ce447aed2279a3e96

  • SHA256

    8407679b8a594a66db48cd92560fac278749e233531254a048215cc948f17d16

  • SHA512

    12d752c7b7721a91e15ae0d3da41a66600a83446797f37d7f91f9e21d6bf443f053095331fa83fa01a64434a9738f09e1b19a188f74cfb0fb4c10c09def45da8

  Score

  10^/10

  bumblebee2908evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral3behavioral4