Extracted

• • Target

    e81f4b65fb98623c6be24865728e0e894403738cd4413d372da32fcfe3c6a1f5

  • Size

    3.2MB

  • MD5

    2d10e35ba9ba3cba78d59a276708efae

  • SHA1

    17500c2931c8a1398c7a303fb4a11ce92b07b148

  • SHA256

    e81f4b65fb98623c6be24865728e0e894403738cd4413d372da32fcfe3c6a1f5

  • SHA512

    7319045bd51600bf5dbbdd275943358e67ae5ea4925d39eab5a2a8f5eadd903302bf91cf37b7d37e673db00ac057cc07e13799185f862f3ebffc0de7f20c3351

  • SSDEEP

    49152:fWsNTq3iNJhyavhqaUq5AXWm9KhyyLrgbOww:fW

  Score

  10^/10

  bumblebee2510evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1