Extracted

• • Target

    document_stolenimages.lnk

  • Size

    825B

  • MD5

    e677519b182abd3fe941293160c5f3ec

  • SHA1

    6e1dc62f875cc2f97114c468b4c98dbfef0adeb7

  • SHA256

    937a0c4449ee87685d7b2c2c2c364108b698ba6fbfd583d9bd2a6521cdf08d8c

  • SHA512

    73f0fc0951cc31aff63ce830bbafa00c40520d97b15445bc5e10074427df88e40d241b4b1d7e1dcbe72b3b692e4100ec4416287edd62c9b438c888a4054d3791

  Score

  10^/10

  bumblebeevps1evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    neqw.dll

  • Size

    2.5MB

  • MD5

    0d9da48b4d94dabe4f2d52e393afbca4

  • SHA1

    220fe1a61a8f977dcc4c9a5d677a2aa972542d15

  • SHA256

    e0ffbd8a2ed4b5f25702c5232732cdccfc7d2e21b8750e08a011bce05130f221

  • SHA512

    e8c2b75df6f7d5a7ef6278ef58ec8d7291f494bcffbbd5f789e0662f598762a05d387c027c2a8249451eb657c37836ccaeeb44685a124e116a4896a6731ef0c2

  • SSDEEP

    49152:D5jpz9L6rp6dCeyXDGAwywzo0xUDLsENLiBfGCYJHrj5AhfsM+5QP+YptuaG17:D59lMsCTzhYpxEbiF/YhjafsMF+R1

  Score

  10^/10

  bumblebeevps1evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4