Extracted

• • Target

    0dSnW/Page.bat

  • Size

    2KB

  • MD5

    8d0a03154bbe82f6041790b08baf39c3

  • SHA1

    c0b78b03e2ba9400cad4ec70d3187fd18c3f958f

  • SHA256

    45ef129aa15193c634cc8badd659c7e400282ecc4759713622a965264b130a05

  • SHA512

    ea1387e77db42b1b3e77013ae5b3aacd89f0d3aaba98c16865a7eac0532027e8c2b320b4ccb212e04d4601fbf2db4a396999bda30fde3adb9527eeb87b86dd67

  Score

  10^/10

  bumblebee0712trojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    0dSnW/document01.lnk

  • Size

    1KB

  • MD5

    c6f1fecaca46ba66f28625f252db236c

  • SHA1

    9078d131c23cdb9ca4839553b1052e12e4fc55e0

  • SHA256

    fbaa8b0ce2175c7a36192b7d4d35b359b344a37a2c2ce1460b7393f21ac8c05a

  • SHA512

    c741047eba96ce3596b0198d81abfa17d53a2a9dce3973ef057f1cfacea537ae13e9f51be30c8ac4d0ee93914905a881a3e498b65ee1a206821a3553a6a21462

  Score

  10^/10

  bumblebee0712trojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral3behavioral4