Extracted

• • Target

    HKpiLfqChJKPLc.dll

  • Size

    1.2MB

  • MD5

    a2a55bdae16915aea3bc1933b04eb5e1

  • SHA1

    83e2082f4b30e6475fdf0eeb435f7ef8500363a4

  • SHA256

    6b3a8f1b3ee2f33912815aa18ed89184ffcc0ddf8619b7551aba216e20e1fe88

  • SHA512

    46269e04b69f1e8fa6346905becfc3e3cfd08a4ec781b11ef4d16b7c4d70fba5186245986b31f68f57866f755c133c248d057e9ea5ccbbb83175e6905401a9f8

  • SSDEEP

    24576:v2g6iSk124v3QMwo04WbKpHd/bq2Nf6lRcN5AWwem6EU0MmJO85:ug6iH13l04yK7/bERcLwBLKU

  Score

  10^/10

  bumblebee0109evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    applications.lnk

  • Size

    1KB

  • MD5

    61f4534b554463ef5a6c0695f78c1863

  • SHA1

    a0373390cdc6edce5af66b0c9657f9cd63d3ab78

  • SHA256

    201199f2481044b6f4252e0109d09bb7bd170715d401ed5762539992557455b7

  • SHA512

    79d38cf25d8bc012016ff737c7a3d9923bb831b731c3fe298030a887883d1b65cd67919e7a6658de74683b80af0cb303b1c3069fdb1eb10fd1293f1d997fbb98

  Score

  10^/10

  bumblebee0109evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral3behavioral4