Extracted

• • Target

    ton/aerobraking.dat

  • Size

    2.8MB

  • MD5

    a91ffc92b46a8ad90412ae91a4b7ef83

  • SHA1

    beb23a8718b77c6a6d46464e5467920c8f4f1ec7

  • SHA256

    2f18bfaeaae34c7bf895a432b297609edfaec4d449b5e3301252d32006ad3e1c

  • SHA512

    7fb0b389850fb49b252c420d3487c5a4ffc7beb7935ca5e8ac6cc9bf5237dc7b8ac2742c2410d88e1efc9b0aa5ccb4d52d70731aec053ec06ec961f87162516c

  • SSDEEP

    49152:B4MeHCMgGF9ZbAfofXT8OLpDXEBD0zxOB5vIKpy8hQmf+8SNKb:B4RCMqkEGwm8JSNK

  Score

  3^/10
  behavioral1behavioral2

• • Target

    ton/documents.lnk

  • Size

    1KB

  • MD5

    91b225881829c940ab5a76b61593e9cc

  • SHA1

    645790942cba7cb63f14891232b22ad978f1141e

  • SHA256

    22546866f19add33035bcf1c135541606ff770df580650195dde6b69c55c37b3

  • SHA512

    1ecbe7dad9128c1ef7c3f9629124db33928a477f84e0a1c65e2afef8c03d9080397d2c1157a03ef942f59fb1f97f722a7d3f679250dc35fe4f0fa69d4ff819bc

  Score

  10^/10

  bumblebee1209evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral3behavioral4