Extracted

• • Target

    Invoice_3406_october_PDF.iso

  • Size

    3.1MB

  • MD5

    76cc5f3c1d058c4f4aa3fa3904136bbd

  • SHA1

    7185475768cb18a51896a83c0a1922beebee5d5b

  • SHA256

    15e47fe96bdf2f5ad760bb7437fb322a865387629f85bd9596c66d414f19a91c

  • SHA512

    6c92e9dc70ef41f5400cb3f96238592467f1f3564796bcb70cbb73a666a7dee750d2f24f25260238ef3fc196f789b107c7acb97f6fea8c85d4aab06caeba997d

  • SSDEEP

    49152:1xkyekKLHC3c8UV3vlQeTeXeTBBJ/cEUmC6TjXXuGiNo4PjNYWPIKl+830CM3JCo:OQteTBBJ/ctmC6fXXViNoajRPtc

  Score

  10^/10

  bumblebee0310evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1