Extracted

• • Target

    required documents.zip

  • Size

    3.2MB

  • MD5

    e90a8f435a6195e481568c18030722cd

  • SHA1

    8a208ec067c7e4d6ac12d5c1c2bd16a00823d3dd

  • SHA256

    34006f226a726c57ee055fa5520a333e34657db681ba4add71c580b2ea179fe2

  • SHA512

    e9bdab4ce5c3c4ccea486278113a4c0eebcf24bcdc1cafd971fa15f58276387785b374d67c90002875b2f54fee29a2351e03865aa198302b0c8993fac7cc9101

  • SSDEEP

    49152:qivSCQ/OKrPtUJMo3OqiLd/+VeKUiGOxjYSguvSfc:qivSCQ/jzaT

  Score

  10^/10

  bumblebee0709lgevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2