Extracted

• • Target

    test.exe

  • Size

    2.7MB

  • MD5

    8fd4a4a504f74b802bfdaf03ec95a036

  • SHA1

    ef941774c3c50582ffaae6cfce6f18e50b7cf5d2

  • SHA256

    14bdd5687f39ec45ec665c360a96e503e0d6abfcb5ce7dc7285cbf2c16e9b92f

  • SHA512

    257f8084312bfbff3465cc5c484c7218f5bda1fa8b820c358ae40b6384e24373763d1f805d1e8d85a5418fc51c8d80959edf673ff3a467f2f523a6a2c53c45ba

  • SSDEEP

    49152:IBJhO6U1TlVSlRRltLYRd9mJ61KcWRN92hz61IiEEI3gL0td49T1LSqah:yjO6U1hVSlR/te2cPo+iI4z+P

  Score

  10^/10

  bumblebee2510evasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2