Extracted

• • Target

    run.bat

  • Size

    67B

  • MD5

    88b70022e95f95d40d0db15dfa5645fe

  • SHA1

    b115f63938e89369cb3559ab15a963402a656213

  • SHA256

    09243b605fb44265e2bd7251ef929986509930171e7bbb7835773ea819342259

  • SHA512

    6c8bf631171a91f23f9c237fc8ff5291d13a5f21a29a8332ea83304760ce86beddbdac1396f0467901a4fc1db9ace1517c2b5d1cd65604e1f944602402ba5b91

  Score

  10^/10

  bumblebee0510evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1