Extracted

• • Target

    NOwPpfBRiTFTYD.dll

  • Size

    1.8MB

  • MD5

    b3ab9b4d0f69155cc7df3f72b647afc1

  • SHA1

    4698056d14689edbf8d7ef1d6b0b327644eecee5

  • SHA256

    8bf1c0d4bf445006046e26fce66e8c45d034c23ec3f73a14d5230b090bf3662d

  • SHA512

    8de0d2cf3be709740e5205bfcb3dbff9077cbaa1ec6cd3c52f7b36d7c6e23940c4230e8c378d0f575952f9120c46e9f44008a4a9f2b52032d9671692bdd8e3d5

  • SSDEEP

    24576:T3HZCk3SJpRELLhZZ63PdojKS9S5Kz+qKyTENoQk9jYfcoucV:T3HZCKLJKVoj/YtOFYfcIV

  Score

  10^/10

  bumblebee0609evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2