Extracted

• • Target

    7aa5af5ee7a10b31309807e9f72ef711cbf2864c17d943ded85ca439b6106ea4

  • Size

    1.4MB

  • MD5

    bfae0c9a0e0f0dd88051aaa8eb2faedf

  • SHA1

    40fde1f9090fce8ef1c27865ff44d33e47fa9c74

  • SHA256

    7aa5af5ee7a10b31309807e9f72ef711cbf2864c17d943ded85ca439b6106ea4

  • SHA512

    df846c0ab7cffc8d65edff807c095b785220b1cfd6244940744222c0b5cf05c4be6248cc172165fbe7c00f0b72dbf6be587fb762fdd9779ba022f0639a62f5dc

  • SSDEEP

    24576:yF8n2LaxtDT0rYOA+nB64XaTL7AXC6r/rHZwNkirBTCGCo:yF8vT2YD+s4XaTL7U/H2NrRfCo

  Score

  10^/10

  bumblebee306fevasionloader

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Bumblebee family

    bumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2