Extracted

• • Target

    340cdccf8bccec7270e1fe2ca48cb329b8270872fbf1a84c7f55642962dc1acd

  • Size

    48KB

  • MD5

    76a230f34d4a3a9127ba6006c1260438

  • SHA1

    c52117e45e24a8c3c6ef53286ff29cfcdd12ca85

  • SHA256

    340cdccf8bccec7270e1fe2ca48cb329b8270872fbf1a84c7f55642962dc1acd

  • SHA512

    c1f32f1600558ccf5898a2fb4d8cf2b34d6380e73c31804e667325fb9e6fa6e392b0da61c86228cc00d7a36b4340a10a29b54d355101a9c95946d31445d63d8b

  Score

  10^/10

  buerloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2