Extracted

Extracted

• • Target

    details.xlsb.xlsx

  • Size

    208KB

  • MD5

    98636e940474f0bebfcc03db617aaf36

  • SHA1

    405dfe612512d6a0a04cb1fa8a9bd3238304edec

  • SHA256

    c25f5f86ab2aa4928dbc144a55a92ed5be6558787ac0f450d6411d85076547b7

  • SHA512

    90601425e5a388b4a188707a9ab72d07b4312092620e75354c144cf1d2a711bd251325d2d13ee72f3432fc1df4bdd0fed5c3a1644223aeea62dd27fa436ba98b

  • SSDEEP

    6144:KehHpGTRt0hgI/qm1Uz/SyQI9dTbmeo70uWoeJJggmA8:KehHYRt0Wax1ASrWfJaZA8

  Score

  10^/10

  bumblebee2010mevasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2