Extracted

• • Target

    NDA.lnk

  • Size

    1KB

  • MD5

    fdc406b3cd7bdcbc6353cd24613136d0

  • SHA1

    fdbd4e1724ee0c44856e634d7c4eef797eced829

  • SHA256

    3d2f1bbad8936c9f555642b7ab2af20a6dfaae047378d352989b8d9d5d5efad4

  • SHA512

    1148b23b1ba84d997653b53552f3008e8cca9c29a93c24cb3ea6f7c03a962ac3a96772504406fd2e733f0ae05d2f0871a2a109e3a76a8ebe9cae91cb93b639a5

  Score

  10^/10

  bumblebee0310evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    clear.dll

  • Size

    2.8MB

  • MD5

    c04feb8231da5188c2fd829a04b08c80

  • SHA1

    a70ebd8d5ae4a926f1227364c014be27e08fd8a0

  • SHA256

    231d52de3ac6088dbf23871340e5495af9e441e0fd56f562f0f22bcb0d7a1f3e

  • SHA512

    eadf248f4fe599af7b889ff1b143eb09ee5b3d5c68e922d06f5e6643c15fadaddc8a61d17fc8ab24991aba75d393e36790a8d5d94b5acd11083a635e2d920b6a

  • SSDEEP

    49152:LUV3vtDSorKBLIXzOp4OuDkSSpc0hRpCLOdX+il7WAVnq:QDdrKBMCN6

  Score

  3^/10
  behavioral3behavioral4