Extracted

• • Target

    af2ee66b2d500592d403d7e9d2fefca6bb4dfda332517a9d29d510d6cb43fe2c

  • Size

    1.8MB

  • MD5

    8e5b5977740c91b2c6c2c7a1526ce773

  • SHA1

    e09187f29416d8e8b5176cb4cf22cdfdf743313d

  • SHA256

    af2ee66b2d500592d403d7e9d2fefca6bb4dfda332517a9d29d510d6cb43fe2c

  • SHA512

    a006467db7f5457d91a82190c5ecad87d722ba2f82123a8c113279764b3341384d8487709213ec82e26b02a7c750b28576196127fefbbe8876f0716044f06901

  • SSDEEP

    49152:+c3D/V8zHZRDr0VzoLMahBrfWvmn2H6C0n:+g/V8zHZRDWzoLRhBrfWvm2H6C0n

  Score

  10^/10

  bumblebee3108evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2