Extracted

• • Target

    MYgiiW0vn3xU4jCrH7135CJb1dHtwALFYxagEG7KZS4.bin

  • Size

    1.4MB

  • MD5

    010d567d0d1d868448b16dfc46c59a43

  • SHA1

    d6a4c3402298582a5ac1dedf4c2e14a0035730f3

  • SHA256

    318822896d2f9f7c54e230ab1fbd77e4225bd5d1edc002c56316a0106eca652e

  • SHA512

    2df55aaaae8ea60c2164993c1e5e48635f3ee8a6a129e2151bc594ff14b0cd5ff9778cc240438902a0055855007efe6458d9617d34a22389a406d41ef1b6a8e8

  • SSDEEP

    24576:ruAojA8HR776sO8p0qonGox07Vv4AlTe+MOF8G4VZ:ruBdHRH6kp0qgIx7RklN

  Score

  10^/10

  bumblebeeasd1234loaderevasion

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2