Extracted

• • Target

    Project requirements.lnk

  • Size

    1KB

  • MD5

    6ca6a8b1a8d781bc91444dc2402d3f58

  • SHA1

    a66015ece818c3c35d0ae8a400ee9c102425186b

  • SHA256

    3926bec362d86edc8fcc4e283d6b93b21108d6b9d194de9fc1108df2944b0319

  • SHA512

    f778da9c3762ceb37b65c6ba6864e6158e44a99eb776108825c02b4bb56dc309ec4998eb66b053cff99984294f49365b6a50bf8e83e07ec58782a80fbdf5b2a9

  Score

  10^/10

  bumblebee407aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    prjct.dll

  • Size

    1.5MB

  • MD5

    dd9751f48c134f502d5a7a5b39b482be

  • SHA1

    d7ecfa85e28318bd0179d321be7d32c468fc9dae

  • SHA256

    cbef35e0d91b5f169a3bd617c9ebcb3ea025439cb98e3d4a7dbeed4be65b6ef2

  • SHA512

    381889e149f2b49a50f312c47e1e42cefd7bb5eb79013b2ff3213b5161160015f7f75d6b3d4d4f9b07a303599e904433a271fdcada8255e7deb229e8ad6dc6b9

  • SSDEEP

    24576:0nA0ZF8YNPCW9dlicjpZVCkgJ0jlSN/wUx1DmFbxsxhz4tW7:0nA0oKPCWocjpZVz00jhUx1D5z3

  Score

  10^/10

  bumblebee407aevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral3behavioral4