Extracted

• • Target

    evwvwet543yc0.dll

  • Size

    2.8MB

  • MD5

    63a316eba32ceedb0a6f2c02499fee0d

  • SHA1

    c95091727e0b80206bc08fe6f5419f7fa0b6a719

  • SHA256

    5c15151a29fab8a2d58fa55aa6c88a58a456b0a6bc959b843e9ceb2295c61885

  • SHA512

    9d17db2d937cffee92c1897e26db01bc1d41262f4aae4fcb6746ddc897a00e901686dab876a3fa48a682efcd617b05dfaa0522f066f6dfca7a54fbda921917ac

  • SSDEEP

    49152:AY1LnDpAyAelZQtflyyyuSXfiCC8M7vZ+x1BxkJj52DTUFPRAK8hVgi:3pDAZlyyyuSXfiCC8M7vZ+x1BxkJjKUq

  Score

  10^/10

  bumblebee2809evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2