Extracted

• • Target

    KcZmTWntdDTIOB.dll

  • Size

    1.3MB

  • MD5

    ded3f8dbe77045060f65ad7a4c27a567

  • SHA1

    f49e9840be5077139a57ed487a6ff86717120b28

  • SHA256

    df19530dba164f8209342cc992fc2822dc233d025affa9a5f8134dc822a5e334

  • SHA512

    efa4b914302b6886b6e954a37942b6c1a339808476c4b29df356f9339a851c37084f996e87814f2ae7d099bc96e28f64d19547493f7c951aed7254828d553705

  • SSDEEP

    24576:ts2hTjqX3PE7W5OIw1KMSQcH/DEQur1NNpNtfEKBKeQ7ENH:ts2ljqvEz1zSZwQuJNNHhEKBKe

  Score

  10^/10

  bumblebee2908evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2