Extracted

• • Target
    ton/aerobraking.dat
  • Size 2.8MB
  • SHA256 2f18bfaeaae34c7bf895a432b297609edfaec4d449b5e3301252d32006ad3e1c
  • MD5 a91ffc92b46a8ad90412ae91a4b7ef83
  • SHA1 beb23a8718b77c6a6d46464e5467920c8f4f1ec7
  • SHA512 7fb0b389850fb49b252c420d3487c5a4ffc7beb7935ca5e8ac6cc9bf5237dc7b8ac2742c2410d88e1efc9b0aa5ccb4d52d70731aec053ec06ec961f87162516c
  • SSDEEP 49152:B4MeHCMgGF9ZbAfofXT8OLpDXEBD0zxOB5vIKpy8hQmf+8SNKb:B4RCMqkEGwm8JSNK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10
  behavioral1behavioral2
• • Target
    ton/documents.lnk
  • Size 1KB
  • SHA256 22546866f19add33035bcf1c135541606ff770df580650195dde6b69c55c37b3
  • MD5 91b225881829c940ab5a76b61593e9cc
  • SHA1 645790942cba7cb63f14891232b22ad978f1141e
  • SHA512 1ecbe7dad9128c1ef7c3f9629124db33928a477f84e0a1c65e2afef8c03d9080397d2c1157a03ef942f59fb1f97f722a7d3f679250dc35fe4f0fa69d4ff819bc
  • MD5 SHA1 SHA512

  Score

  10^/10

  bumblebee1209evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral3behavioral4