Extracted

• • Target

    af5af36999fcc71cf7e93bbe64bb6299509dde3e40c5b78978ee3cd5b5ddda7d

  • Size

    2.1MB

  • MD5

    bda498a62a5b68b5c8221807723d97cb

  • SHA1

    f5383697baf1a1433fe5dc948c842c55af84f949

  • SHA256

    af5af36999fcc71cf7e93bbe64bb6299509dde3e40c5b78978ee3cd5b5ddda7d

  • SHA512

    bb8e300ba275bc982252fb60503ac453a663f2f1b4a4803dace2226fc2b19cb43fa630fec1a7c7b67667bce014f9534ab855a3d1cb112c37dcd080ce40c01823

  • SSDEEP

    24576:BsuWJHq2ZaUp3ZWSH1YuAB8EqU+7nm1CJDKL75F1ZuPZfSpNRuXDsY22G9KPzmkX:KpHqxAZRrA8XSIb7GtY

  Score

  10^/10

  bumblebeef1loaderevasion

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2