Extracted

• • Target
    af5af36999fcc71cf7e93bbe64bb6299509dde3e40c5b78978ee3cd5b5ddda7d
  • Size 2.1MB
  • SHA256 af5af36999fcc71cf7e93bbe64bb6299509dde3e40c5b78978ee3cd5b5ddda7d
  • MD5 bda498a62a5b68b5c8221807723d97cb
  • SHA1 f5383697baf1a1433fe5dc948c842c55af84f949
  • SHA512 bb8e300ba275bc982252fb60503ac453a663f2f1b4a4803dace2226fc2b19cb43fa630fec1a7c7b67667bce014f9534ab855a3d1cb112c37dcd080ce40c01823
  • SSDEEP 24576:BsuWJHq2ZaUp3ZWSH1YuAB8EqU+7nm1CJDKL75F1ZuPZfSpNRuXDsY22G9KPzmkX:KpHqxAZRrA8XSIb7GtY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bumblebeef1loaderevasion

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2