Extracted

• • Target

    bb.img

  • Size

    2.7MB

  • MD5

    19b54d91705cce89218ece1e52bdb7ad

  • SHA1

    905723cb555878c30990b4dde712279a9dd62f25

  • SHA256

    fe2568cea3666dd24343675139ecc41ed6515bb7ef3a8c429d081d77ce4fecb4

  • SHA512

    9c03491da4b2f2232e3a41532bc5dfca3c311c4661e4ad04a4f0af1cfe0c26f1f7b171190531e4b2362c280cfdd93bdc4ac9dcf290f157edb90be33a37f48adc

  • SSDEEP

    49152:2ayur8YwnS01ZT37lLtdgnU46t5ABYUwdXgHJS0IHgGRtO2a8:2jQ8YwnS01pt5ABYUwdXgOA0

  Score

  10^/10

  bumblebee0209evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2