Extracted

• • Target

    Run-DLL.bat

  • Size

    34B

  • MD5

    396374ee917bc1abedd996c8152a4454

  • SHA1

    dd69c36489b15a4057d8cceef4b1ff3fad4f8a2a

  • SHA256

    5663fcbbdbfdd1b78cee360919363009cdeaa58189ce5aec87d2014f02cc4001

  • SHA512

    3a3e3e7015a9818741d0641538bf6b0f77066b206ebc0f8b76127386b79ab05993ebb9a35767f22bac02540ec6d6a686c8ed28c51706b4b4e7f9c7faa1012b5d

  Score

  10^/10

  bumblebee1909evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    nWysXc.bin

  • Size

    3.6MB

  • MD5

    3ad465cc538b57026aa28b1157885621

  • SHA1

    1715b6a42f9cd1ed6ac0789d3255d9cb5b83bb74

  • SHA256

    8fbe7927d62938479125474d0e634c5e50d88a47beb6e802d5ca8ef52cd3c021

  • SHA512

    22425364d813bfcb58ac87cec9f575265fb2b26046dab664bcda649a598e0cd05b9e84d7fe32ae7471d3f3882eb0f931de7bdd318debd2c7f54fe332a824edbf

  • SSDEEP

    24576:2BeR8J1ZadeRT8E/xRm8P2IHzYQEitobudhkIJvHadqG6p02Pd0p7OMlh72Mm3Dl:4i8JradeRQG

  Score

  3^/10
  behavioral3behavioral4