Extracted

• • Target

    Inv(05-19)Copy#10-44-05.js

  • Size

    777KB

  • MD5

    2f9a34e5769063b7357414e4158d7831

  • SHA1

    8c67c7646ce4b085c6f45863a9d0e38742cd688e

  • SHA256

    07d2cb0dc0cd353fb210b065733743078e79c4a27c42872cd516a6b1fb1f00d1

  • SHA512

    6c71c761fad3319d46852381e05cb35100132c5ba44ac986439cb327d5d9d4b1a83a88cb84d95e192df893a93e53aa73a08127267cd0a3b82a23f57da8c7858e

  • SSDEEP

    24576:63BAIiUtmsPkFUcZnGVVTiEKMqSFcpNSXpNiELOjoEzZcQlGzJpxuJNM3cBFWUQo:hwmsPkqknQVTiEKMqSFcpQXpNiELOjoe

  Score

  10^/10

  bumblebeemc1905trojan

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2