Extracted

• • Target

    1.msi

  • Size

    3.5MB

  • MD5

    e1abe0b693e8ee3df8367caf14f8565c

  • SHA1

    14867c8c4bbcc57efe63a71bfcde4cf832be9b2a

  • SHA256

    6fed6902e05e825c5c600df452de46736263d58920d32a9346b50c6248384211

  • SHA512

    f51b5d36761d9e8443809056c508e43ff668a858c02c81bb95d10cf333af1eac587cbb14e6a3b98b23845aee6d6afa35999cb2540a13846ba0864bc90f2e9be6

  • SSDEEP

    98304:OnokaJXwylk5q30yI43EDhKgn8owQTJK/gQm5z/K:nH753iYgdOTmFK

  Score

  10^/10

  bumblebeekp2704trojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2