Extracted

• • Target

    ZRoeaQxZZMZDVb.dll.exe

  • Size

    2.0MB

  • MD5

    29a405557da7bb24b2f278c5c46dfd3c

  • SHA1

    a089591a65546d9f25e769c7f22b0c61e1836223

  • SHA256

    0e3933b1489a91bfe99dd652d7e64c09380b210d2404f32b26251d34fa58ca8b

  • SHA512

    b332d39986610cc8a1e816d567107778f5c9e45d6bf55c614e673f5853b990abb312a052773afba6eb8a0fb3f5d942d010f7188ccf36f79f3e8a86c7e65731ba

  • SSDEEP

    49152:wivSCQ/OKrPtUJMo3OqiLd/+VeKUiGOxjYSguvSfc:wivSCQ/jzaT

  Score

  10^/10

  bumblebee0709lgevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2