Extracted

• • Target

    HKpiLfqChJKPLc.dll

  • Size

    1.2MB

  • MD5

    a2a55bdae16915aea3bc1933b04eb5e1

  • SHA1

    83e2082f4b30e6475fdf0eeb435f7ef8500363a4

  • SHA256

    6b3a8f1b3ee2f33912815aa18ed89184ffcc0ddf8619b7551aba216e20e1fe88

  • SHA512

    46269e04b69f1e8fa6346905becfc3e3cfd08a4ec781b11ef4d16b7c4d70fba5186245986b31f68f57866f755c133c248d057e9ea5ccbbb83175e6905401a9f8

  • SSDEEP

    24576:v2g6iSk124v3QMwo04WbKpHd/bq2Nf6lRcN5AWwem6EU0MmJO85:ug6iH13l04yK7/bERcLwBLKU

  Score

  10^/10

  bumblebee0109evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2