Extracted

• • Target

    7df703625ee06db2786650b48ffefb13fa1f0dae41e521b861a16772e800c115.exe

  • Size

    2.1MB

  • MD5

    40ee908eff9418d1cbcb36ea516ca34e

  • SHA1

    e13e947f3ce59a2a58ce09c2d8888053d685fa44

  • SHA256

    7df703625ee06db2786650b48ffefb13fa1f0dae41e521b861a16772e800c115

  • SHA512

    eedae343bf53411aa9a64e0f6ae9ee1ac15b6cdc02d94894604974e5d0ffcafc56f9df9afa368cab38a017785e559d75bb9dea95bffc78088048cf3b1ec7d639

  • SSDEEP

    49152:AgbA0SNOgGbH+/mrzAnO5oEshZHFTdgmH:v20gGjnrzAZEIZHzgmH

  Score

  10^/10

  bumblebeemsievasionloader

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2