Extracted

• • Target

    RzTgomzVMyYvLc.bat

  • Size

    1KB

  • MD5

    44852447be8fb0979b630e4ce2f23311

  • SHA1

    0d5bdc0eb82c3b0cccbd89d9c656108f5eb741f6

  • SHA256

    d8da10ca4550a74f46f890ff2165044d95e1c0c7f97078b4c128a8399cf96e87

  • SHA512

    8eadde672ebf7e51816a117913bb977d90591ab26efe210e3d88fe72297f3c1facbee663119ecf14b9d731be6f1d96e2925f197578f2dab3154be394fb24f778

  Score

  10^/10

  bumblebee1011trojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Blocklisted process makes network request

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    nCguwHABqhXZAo.dll

  • Size

    839KB

  • MD5

    8b17aeaf86245484f2659793ad39b9aa

  • SHA1

    95366b54dc9a7c321d547ba914f9ea320c6ea22d

  • SHA256

    ff952c205121ccdcbc54abd5b7cd1019a52f45685d77259ffced7c0464288bd8

  • SHA512

    9cd6c231facd792c7db43927475ebfc04719afc30de420ddceb3d44afc3285d735853324866efa6b2d86a2706cd45f9c5eacbbeb0fe3f34ec54d1735ca5ad166

  • SSDEEP

    24576:E1B78wzG6nRH70jVzHnXTvKSS2XALD6Gpg:gz/HABD2226

  Score

  3^/10
  behavioral3behavioral4

• • Target

    project details.lnk

  • Size

    995B

  • MD5

    8c1154a1673b2f2839b02647c6b2cb90

  • SHA1

    06d134201da42ad5096f1e71fd67b5b912a06cb2

  • SHA256

    cb19b2eb0143e6def46886c9c3e32e4fdbd22bd577d67bb9a16b437183869e0f

  • SHA512

    3fb04105d57344f0148097cbf9d5f52f694d65e9d3c5a41614b3fed3f0f2b30bdc5b9d3f26674b228326c714c067b2d40a013ff342fef337055fa129ea1ca6d9

  Score

  10^/10

  bumblebee1011trojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral5behavioral6