Extracted

Extracted

• • Target

    cisco-anyconnect-4_9_0195.msi

  • Size

    4.2MB

  • MD5

    72f7a880209c875d48c153b5b8db71f9

  • SHA1

    f861232236ddcd2df75dfe77c7ba5342b84bf777

  • SHA256

    b1bae0bca6cef482524586746abfda822829edad434a164cf764eb34c15736a6

  • SHA512

    fe9c4f18ac24f89aac02dcc372a65c9d611c3d4755fdd060ae50d79228192b788fca61aef6776b0aa4576d5f124de77ec2b7a790bd2d87099ac357e165ddaac9

  • SSDEEP

    98304:PPKnw39kiUnMUYeg8F1HWMUKFln1EJCl1ZPYzrkFE:6wNJUnMUYetUKFZ+CFPY0F

  Score

  10^/10

  bumblebeecis21503persistencetrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Blocklisted process makes network request

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1