Extracted

• • Target

    RunDLL-1.bat

  • Size

    37B

  • MD5

    7a90cce379f52ea107d00fa548e39018

  • SHA1

    33438af9a7c7e8d10e4028dcbd772c168298c3a2

  • SHA256

    608727a7e3ae8591377a6966d2d15f087dd13a5b4668b8d814a8e09b540f4bc3

  • SHA512

    2a3082e6b1441393a3515612d844ca50204c551453fdd6da46d05cefdb425571d9d58005ac0eb64032e55b5ed4778beca4be885ac34091f85d50c585e0e9f0b6

  Score

  10^/10

  bumblebee0510evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    overpowering.dat

  • Size

    3.7MB

  • MD5

    350102fdb77e5a8486717169d2b95b37

  • SHA1

    34208084563bc9073936858f2a0b324fe108c931

  • SHA256

    a3cae87217bc4cfbcc72a6b02b086c85cdb435064c277b36e76a172998f9adb8

  • SHA512

    95951f0e1f376996c7e1dba9533e64446a9b915e104740a61de66a214e7b1c00c85bf0b437187df44e2aae44d7a361fe27ad3e6b8dccf7667a56892850a624bc

  • SSDEEP

    24576:/zZvRKkaaoBioEixeKVS0HtSgQa4YDBqxP+XfglvQkTzW0jyTj1IERp1MlF8eZgy:/Nv4Ty2t/Qa4YWcfeqvmIo1bjLJeQ9p

  Score

  1^/10
  behavioral3behavioral4