Extracted

• • Target

    54dee3dd5f14aba8b0d62ceaa419a777a3f1f070b49767f6545a2729ab65d3b1

  • Size

    3.6MB

  • MD5

    77e5ff1e4eff690fdcc6e0ba9877e1e6

  • SHA1

    721b9448b4e54046e156b8ad3b35a8833ecd5daf

  • SHA256

    54dee3dd5f14aba8b0d62ceaa419a777a3f1f070b49767f6545a2729ab65d3b1

  • SHA512

    dd853f675de53ae50ea1618c097a2acf2c332c9eb35efefbe6e2dc56eaf16b7ef4bde5f496fe3c16ec1a877cbd0865600ce78ee378a30f37bb9df010511cb686

  • SSDEEP

    24576:6uMZRLX8+gpL/+2thqiWjJa9cRXtdN86CHXuPVvDVHBXVWcs+lwWTAYq3/ny1Ow+:6jZJ8+gpL/hWjoe

  Score

  10^/10

  bumblebee1909evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2