Extracted

• • Target

    of/Office_Install.lnk

  • Size

    1KB

  • MD5

    6b235a615c34bb2f86e23f9bd86e9bb0

  • SHA1

    5d0acfef254761ee10ef3c89c7c078b19dbf2bf2

  • SHA256

    baa473b56fc40b073f0e0b5f32944857016e6e7fda120385e5ce677710d9e08d

  • SHA512

    2facf906c4cd1004c9f3e75bf3be458f6ae44847f3447d933f3d849d5cc03d064cae1594e8dd9e6d70e71f09e1e514cbce3de185281934bc5ab253afb418312a

  Score

  10^/10

  bumblebee176evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    of/office.dll

  • Size

    1.5MB

  • MD5

    1b0a14fc9aeb3b9c184fd011dbe69027

  • SHA1

    261fe4a73360fc1902705c1bc9d45ce979094cee

  • SHA256

    ca99667840a239c1a7d7f91b9432c0dcb5b7d8f7696cf79dd94ec2a9773f9bc3

  • SHA512

    3fd5e9bcdedd45b4c686544902086225c1f0b86d5156eec74e13737a6fb467edf3de4ff3e31bc02dfbafb16c07b58ba876174c29da489126397dcd999b73f8d8

  • SSDEEP

    49152:6J/gKqeCzyMiBTe49pFNEI7BAcPz0AhbzC32N8JfTJJwQrsUoT1TCjK0q58un0K6:6JtBCwFt7BAcPz0AhbzC32N8JfTJJwQF

  Score

  10^/10

  bumblebee176evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4