Extracted

• • Target

    doc12QICZ85.wsf

  • Size

    178KB

  • MD5

    518fc2e647ec1a068d96699a7c81f09f

  • SHA1

    2f1852128b1797ecb20557109c503197992d5ff7

  • SHA256

    5b7dfd88fcbbbb7e3d1b4b6606c4fdd10397dd5c00e18cfe83cd9a94ed136246

  • SHA512

    2bf8fe6ac6316b64ba2f57ca9e6bdc922913d07b5a2cd9efeae453feb2ac7bc9e621b706ca245673a9b2d73d437592b9f2cedf78e5370db8f3dc8e6afbf3ee76

  • SSDEEP

    3072:1eULHHO+zbe2qOX/w+A429OutoWjVM8kgCRreRlW+Q5HUJAWo5hiaPJhO5Q51lJO:Y8SOXY7txjVM8kgUeRlW+FAWo5AaPjCb

  Score

  10^/10

  bumblebeemc1904trojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2