Extracted

• • Target

    d6280fd8cb64224c747ac376c7f2db0b88a5d366dff2dc28a0b2fb14d1bfa538

  • Size

    1.4MB

  • MD5

    66e165bc3ba1eee99b68b740a77e250b

  • SHA1

    29d7526882c9a2cecc218cfc557693d981dcb594

  • SHA256

    d6280fd8cb64224c747ac376c7f2db0b88a5d366dff2dc28a0b2fb14d1bfa538

  • SHA512

    f3ff41d11eef87c31e42fb8c5b3a1195dd10f472cb7ac455a58a84699e1a14426a3d8639708c56b5916d0ef04e2ef13008b65835259737656cae4e8735bfb360

  • SSDEEP

    24576:cBIspDFt51KBpJHgFoQfiBkgjuuYMfTkUq0uPnUgtpij/3YnV:EpDX51KBpRRBdjiqT1EnTij

  Score

  10^/10

  bumblebee2908evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2