Extracted

• • Target

    PnrirLoslBOSWR.bat

  • Size

    1KB

  • MD5

    6fe0cff624e47547185b869db1d72f45

  • SHA1

    ed28b0e2acc7e357152001fbeffdbea6ceab0230

  • SHA256

    4685e7be2b60d0edc5480a4befbac6130dc65c7bd149f6010b86d24a601bcb3f

  • SHA512

    1613a4eec4e9f62379458e0c1d3fcd5de453174f445a8ebd673ca1cb22f26f32d2b58bd0da094deed14af8d1ed7a3f7bf3e026702c751883c81e79c7890aa654

  Score

  10^/10

  bumblebee2609evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    details.lnk

  • Size

    995B

  • MD5

    b5d21515040f492ecf2cdab2cecbee04

  • SHA1

    6a288e044cefd4c83fdd07899445755a3e4cdfd4

  • SHA256

    ae3360b50c116599a7cb2750c896e4223097e8c7224242d5844ebee0808c089f

  • SHA512

    0bd2564b4c078685a7fa321d55655ee8c65a2c559bff231c0d17c80776e8e36d8b251aee85f1e3000e436e03266dab58954640058861a122d71d1d601efe999c

  Score

  10^/10

  bumblebee2609evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral3behavioral4

• • Target

    lqDwAhoXOlNwLd.dll

  • Size

    2.8MB

  • MD5

    facf173726f6b3c0dfc6bff5b223e67b

  • SHA1

    d26afc80fb12850d46683b8c217e07dd96277963

  • SHA256

    07240bc14c34f1bcac94a19e0d5e6331d98717a65b76f7a106216a41de782a8c

  • SHA512

    230800d537c32f8329dca1e54fc7c73cc35c809f6eb4f169dc79f4d91c155665f159b5cfc203c584970807b95c5975323690288b703c1f2c7136f4b6e176e3ed

  • SSDEEP

    49152:cUV3v7mzyveqNwoqmTL93qSsgMObQGkCxnkaugjSo51OZ+BCPe6UNb/ed9rg2UsL:bmehNdqiL93qs3bZkCxnkTgjSovh6+bG

  Score

  3^/10
  behavioral5behavioral6