Extracted

• • Target

    f1b84562b52c8f60ff161b2f4a6e746276a750e703e43a053658f6f4e7412c4b

  • Size

    1.8MB

  • MD5

    ce1f05304d82acde02b39c22e237d256

  • SHA1

    0b569e1b4b24f479d608dace86fb8382cc57e85e

  • SHA256

    f1b84562b52c8f60ff161b2f4a6e746276a750e703e43a053658f6f4e7412c4b

  • SHA512

    bf0ed3597b24f1f926c0fea76965f0478d853a5854af04ee96d63ffb828b5960c2bf06bf6073430cb1a63fd0067dce130bc00670d18bc5e2b18bffd3942ae284

  • SSDEEP

    24576:e+zUAOg1kx1D+acFnaBpCTt0PLDDkrF0GI1ib+2sq5tcGKaPI8zeMqqj4Dy5dD:e+zqgafArTtAfaFy1e+2sq55Dey04

  Score

  10^/10

  bumblebee3108evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2