Extracted

• • Target

    invoice.img

  • Size

    3.8MB

  • MD5

    7cb4f9414c3012a937437509e0b67478

  • SHA1

    1b14a60cfad25c27191a4630e08b55a63c1ad86e

  • SHA256

    091bd738da3c006d6a2484b7f98702bd9de63780d53c8af99f7a4c57ac05869e

  • SHA512

    aeaeb3db36dcfdf651658e91dcde226127adef433272d4b16b1bf2cf10f066baf2c94cf8bcf248fb6c6d53a2a97179cedd1959a42ece7d2c1beb99bae1d5c5c9

  • SSDEEP

    98304:EHRol0dMODe4hTMJdbmzT82KK+6nkRq9qczLSS:EHRo0Mui6f82KYkReFT

  Score

  10^/10

  bumblebee25htmlevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2