Extracted

• • Target

    documents request.lnk

  • Size

    1KB

  • MD5

    c792b04c766ab57b49f5cfe33552a0ba

  • SHA1

    badce1297ba8768de589ebae02c955fc99dd3fbe

  • SHA256

    ccbd285306a104b9c4318202bc4afa15af5d285215922877086be4f928494112

  • SHA512

    f9351239f546174314f2ddb2e311a9b8053ca2ab2d59d11541822f2df453ccd8faa477564ef19a5815b72c90f738fdabfc6c03592e9c9f81f18c254e79ff2747

  Score

  10^/10

  bumblebee276levasionloader

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Bumblebee family

    bumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2

• • Target

    stats.dll

  • Size

    1.4MB

  • MD5

    c978236aacb56975104135b96301fd79

  • SHA1

    bc9e252dbbbb25a7d3895abf7873ad14ee36c268

  • SHA256

    b8e8284f3e999db3333a0a8e79132cce4462ccc3c5875b1be7f5e9a2d8e44966

  • SHA512

    b6f3a476361b2fe7f262486a0b9167555ec77e5915def548c4b4b01bc93cb0e853b1f64f7177998f4216476e8e5e0cc7151f017252a9f0caef1da3c2baa3871c

  • SSDEEP

    24576:OsgeDrXBXQS1d7ns+pHB7e0L3/SQUOyxv0dzf9044vunpt:OsgeF7ZsaJR3/SQUO+0dLcv

  Score

  10^/10

  bumblebee276levasionloader

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Bumblebee family

    bumblebee

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral3behavioral4