Extracted

• • Target

    0ef183757b866da6fb4f743d84db9b4c83b18a12fac3bca9ff2a8367edbf7fe7

  • Size

    1.2MB

  • MD5

    f3a7823ff8a7ba474309b7df86e878e0

  • SHA1

    186fdb86f86c003816af88cfc5fa2f05db62e7e6

  • SHA256

    0ef183757b866da6fb4f743d84db9b4c83b18a12fac3bca9ff2a8367edbf7fe7

  • SHA512

    8719e878358bc49b41fa9a975145cea234eb0e328873ff1fd2bd8c0871f32c051ae30b4271af1eb0e1469f17d5cac9a66212876ed76079034e656e3a10518897

  • SSDEEP

    24576:rdJ8126w6qin6t4WbGr69UH1RHL0j+OQ/2rHiMoPj+Dr2gUfv7Q5BhRR3vrB+ncu:r426w6qi6OWKrsw1JL0jI/2rHiMor+DG

  Score

  10^/10

  bumblebee1306rdefense_evasionloader

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Bumblebee family

    bumblebee

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Blocklisted process makes network request

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  behavioral1behavioral2