Extracted

• • Target

    ZDxlKIroVIDBQm.dll

  • Size

    1.4MB

  • MD5

    fa55ff03674d60bfe4a119fc395f847d

  • SHA1

    a23c49f7d94a930cbcafa91be56accb66694012d

  • SHA256

    083a4678c635f5d14ac5b6d15675d2b39f947bb9253be34d0ab0db18d3140f96

  • SHA512

    edbba800c34a31eb38b24dca1cd7a012e3aaa90aa21d560bb4a8b1f4f51afb95596a1f32364ec43e27b5d1d994c9c7c1c2424abf83ce0a5638af8ce3dacb69a0

  • SSDEEP

    24576:As2xtHRAeUWVXfEKsjd3c0qd4suo+NFwWAr8IV3oe/6pE9bjk8T4VgqS:Arxtie1VXijdMf2sJ+pGVJ6pEFjIS

  Score

  10^/10

  bumblebee2908evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2