Extracted

• • Target

    document.lnk

  • Size

    823B

  • MD5

    535f612cd22942a8f831c8f08cd880b5

  • SHA1

    b095440d2c2868cbfb0e95ec32da10dd9f2aea48

  • SHA256

    a03ac8dc616ac88e9aca6efe1171dd962df0895935ac1df637533fe6c40a8ca8

  • SHA512

    725e3650ae1724edf247afb5e2c809cb0d277ac887df6f9ca9f03d9386958eac7b07908e91c6cc4fe757a0ed314221d539fff29f48037c56444d8298c2820ea4

  Score

  10^/10

  bumblebeera1104evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    vil.dll

  • Size

    2.1MB

  • MD5

    ff6db6c6dfb7c7a9da47d359702ec4b3

  • SHA1

    69dd95131829bb8b983d5fe0ee611e7ff63037b2

  • SHA256

    6168d9f1cb0bc329fe76a0ebb8a782617de9bb0da2372e1f2728db856daf5007

  • SHA512

    a386fbd06168c9aa0b105cee148098706b77e1d1733da5bbda62012dd0736fcbf4e36f696148fdb0d020b5a64192b424cc8b7dcb2ff7e781ffa949118eacc744

  • SSDEEP

    49152:9pfaMa7wkHW4GnVibdZAi6WcJQc2CU/Z9dYn0XZW1:T4KVIZAiTcqcHkdEII1

  Score

  10^/10

  bumblebeera1104evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4