Extracted

• • Target

    information.dll

  • Size

    2.0MB

  • MD5

    c9216484a6371b055705ec5f4098ab01

  • SHA1

    a13903e50408e11996159fba5f7deab1e73e8f08

  • SHA256

    fed9bc8df9141f8f8f7a9203bc26b5b22123c154702fcd625379f2f7ecd31cb2

  • SHA512

    64485bb8e1845a29f9d60343a0bd6fd8de4220aa83f3cd19eed47737642b79db2753106192798d495202e74016f2e845d161c1362ad09b01104f9cfb8c939359

  • SSDEEP

    49152:G+MhMvcxBbQLsks2EWZs09Xl3ZF9EK99sq+Zy1RDZ5ko4Ebv5g7H11zLG0ZriPkb:G+Yu/ZTjLHS3bmdeQbzWIu78ph13l3bS

  Score

  10^/10

  bumblebee146levasiontrojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Blocklisted process makes network request

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2