Extracted

• • Target

    Invoice_09-12-22_order_83.iso

  • Size

    4.2MB

  • MD5

    0c36704774ee6638904dee295615d300

  • SHA1

    cc1e1579b73dd1dac3fa16156e0056d11eaa3e87

  • SHA256

    5d5502e6a5a6ee273ffa23e8a400a1aa53d98a86299996194c338403098dcbdb

  • SHA512

    1fff99909ad09497cdc6f5c37ad7f3abc307daf0a7000d5b0e1456e2d184aa5b44b774f3ecd42f2fdc9d001566bdbb8c20900f1fc7bf78df925c85f75ff1bb34

  • SSDEEP

    49152:af+yMskuLMNWBqp6kzWjaNRVErtAuOm5gE2dkPa:af+EkuLS32tqmyE2Gy

  Score

  10^/10

  bumblebee1209evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1