Extracted

• • Target

    9hloq0.dll

  • Size

    2.6MB

  • MD5

    2719b9bc4e8a2f3f033b9ebf75ba05cb

  • SHA1

    9bfdeae0f5dd641c5d9b945dc91e64321f21587b

  • SHA256

    78beecc828a622f7cde900a68e5653438b60f9bdaf5d733996c499241c6d7130

  • SHA512

    e137ed1116e571df3c3beaaf451f026e3d2b7669dd59f1ac2d15c3d6c2669404b6ab2651ce374704f29120ccddba040cce1067ae2ec350b907426b184885f871

  • SSDEEP

    49152:7J6uk7ObJRXJ/tcgZOrclKg3uAqI6nwopOwmJQai7SfsEP5YnWPAIO/aGqvxK+nt:7J6uGObJRXJ/ygZOrclKYuAqInRJQaiS

  Score

  10^/10

  bumblebee2504revasionloader

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Blocklisted process makes network request

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    documents.lnk

  • Size

    1KB

  • MD5

    3cdae338d436fa208f373fe79abc6263

  • SHA1

    1922c3c625c8d7bbc7c6e5cc0adcea69b7b14722

  • SHA256

    d96eeee2860e53d004977c823980b5ecc619e4d875ea545723ff1d8e6c526e6c

  • SHA512

    d951b3be527a0b4034fff01a6a75246c416660279163785e7b4d4462a6fbdf9177158862c7ad958e1861b0a9212265df081647b2ac4182b59fce8535ab3b28b2

  Score

  10^/10

  bumblebee2504revasionloader

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Blocklisted process makes network request

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4