Extracted

• • Target

    abaf649e6440033ea250691e6bff02c8924a5f9b827168f576606835d7a820a0

  • Size

    2.1MB

  • MD5

    5758813f20b1b3f041b20f700e61ca2c

  • SHA1

    5cf76172c4b3c33f2f64536ebdf7d6a5935350d0

  • SHA256

    abaf649e6440033ea250691e6bff02c8924a5f9b827168f576606835d7a820a0

  • SHA512

    69b1955969eb7f7712698360ce85baad22fa90c3ca3b58fdaeb1637f7119639aecb9eb215e35c55aa0a2c375601a54633fc3b26badcc24b350251307130870d9

  • SSDEEP

    49152:tbhl087l5fJeS/DrSoUtP9qqyD8e3+DSP9yJoZS:tLTfJtylPyD8e5MJoZS

  Score

  10^/10

  bumblebeera1104defense_evasionloader

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee

  • Bumblebee family

    bumblebee

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Blocklisted process makes network request

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  behavioral1behavioral2