Extracted

• • Target

    applications.lnk

  • Size

    1KB

  • MD5

    8e6a8c26d28b532737bee33c678ce4c1

  • SHA1

    58b2afed5538ff1c65552dfb2ea5059edacf00f4

  • SHA256

    777a7dbf91be6ae40c3ae08bdf42fcdabfbddb7f62c8d39fa604c9de5f6a17eb

  • SHA512

    dad7132bf6483ec651a57c3a5a543e62a4a30e2eebf115ec37f35d295a8b7b0bec7294c0fc376a4b3d93663cc76715baa6cbc88f042826c417e72b69fe88d6d1

  Score

  10^/10

  bumblebee0109evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    hWnSpOvpRhOazT.dll

  • Size

    1.2MB

  • MD5

    8f0cd21b81355bc7add20183c8001343

  • SHA1

    620347cfd30f1283a96ac9317bc32ad1f49937db

  • SHA256

    ef8811267e17be79b5960297a655c1281697fcba193269156a15aae0ac293e8d

  • SHA512

    3295a6911c669a2c9bb8f250af5d0fae2f50b91e7ee3b147759ab063a097e5705ee98d253991cd47fbcbbeb0cbf4a729f8a50559ed53f685e33241373dbbfb20

  • SSDEEP

    24576:zdFModrSTrbU4ErfCUQgQSnlGFNJygYfwvYWMdsA:BF5rST3XSlGFNJydfwv2d5

  Score

  10^/10

  bumblebee0109evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral3behavioral4