Extracted

• • Target

    Documents.lnk

  • Size

    1KB

  • MD5

    62c2908779e9d600b7f173349b4e0336

  • SHA1

    6cdb058004c035650018a2467c61ac9c70c103b4

  • SHA256

    1b566c56ec82909b3022ca375323a9fee0ccbbd86a8a8735ffc352f4a035b969

  • SHA512

    2d9edca7584c4abcd741b4b206536dd55165b2a08e9c634d7c98dd29885f66eb3ebf112581e03fa058f3332aff7dc238c1b14e4818a9bf715c7a5360a6c3cf42

  Score

  10^/10

  bumblebee0709lgevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    ZRoeaQxZZMZDVb.dll

  • Size

    2.0MB

  • MD5

    29a405557da7bb24b2f278c5c46dfd3c

  • SHA1

    a089591a65546d9f25e769c7f22b0c61e1836223

  • SHA256

    0e3933b1489a91bfe99dd652d7e64c09380b210d2404f32b26251d34fa58ca8b

  • SHA512

    b332d39986610cc8a1e816d567107778f5c9e45d6bf55c614e673f5853b990abb312a052773afba6eb8a0fb3f5d942d010f7188ccf36f79f3e8a86c7e65731ba

  • SSDEEP

    49152:wivSCQ/OKrPtUJMo3OqiLd/+VeKUiGOxjYSguvSfc:wivSCQ/jzaT

  Score

  10^/10

  bumblebee0709lgevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral3behavioral4