Extracted

Extracted

• • Target

    comics.ps1

  • Size

    2.2MB

  • MD5

    2809cc87a38fd5233134c7428b380f2d

  • SHA1

    47f1282a61b8090c7b335059fd6408c573b061ca

  • SHA256

    b75bb6ee05805acc5898ed2ce9f8313d20672acb1908693b1b368e71c169c447

  • SHA512

    bc0afcd7ef86ca2cd40e7a489b8a523666412b6c43ea60b6615a2aa37fed49dc741d33af3b961dd76e2ca90f5d437838dd4b5cfb28500288d83433746083bc0e

  • SSDEEP

    24576:wOctC+MG8fRwhhUSmA/xBCXaEGNFpz4vGE9TUUrKApoxELBczlB:KtCd9RwRa8rsvGyXoz

  Score

  10^/10

  bumblebee0603cctrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Blocklisted process makes network request

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2

• • Target

    titles.lnk

  • Size

    1KB

  • MD5

    cd40170ef364117a2ee437c47ec6b564

  • SHA1

    48346fe1585ead2a8ab4f5fdccd264c5f9cd502a

  • SHA256

    24bb33a3a191cb0fba721820a31a8560abd7b3d0fafabe5f85a700e47772b571

  • SHA512

    a901f85abbb2be9d8f2165de0aceb502c8c95797c987ad0fea4a9781eaf509d2e1e4ccd5b1c51eb4b16d86a78fcb25c52d20b91623c0511c89c4eb585f6b209f

  Score

  10^/10

  bumblebee0603cctrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral3behavioral4