General

  • Target

    SecuriteInfo.com.Exploit.Siggen3.8959.26365.55

  • Size

    386KB

  • Sample

    210128-kt8mmnervn

  • MD5

    d16f23f1d5b520fa2407793e2318bbec

  • SHA1

    58d25900741a1a1fc5e8617322eab6957c520c44

  • SHA256

    cf4c2af3c3e4ec4658c9ee98da829643c85071dec8b91085af1c2ee2811d406a

  • SHA512

    93cc56319363704a325703ec512643ad15041def3abed5e56f1029d9658d63ee03444ef6e5c59654ce91f97551366fceca6b0d34c53fd78f9c726b69217a4c4c

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://213.252.244.225/font.tiff

Extracted

Family

buer

C2

jerryskaxtebilling.com

Targets

    • Target

      SecuriteInfo.com.Exploit.Siggen3.8959.26365.55

    • Size

      386KB

    • MD5

      d16f23f1d5b520fa2407793e2318bbec

    • SHA1

      58d25900741a1a1fc5e8617322eab6957c520c44

    • SHA256

      cf4c2af3c3e4ec4658c9ee98da829643c85071dec8b91085af1c2ee2811d406a

    • SHA512

      93cc56319363704a325703ec512643ad15041def3abed5e56f1029d9658d63ee03444ef6e5c59654ce91f97551366fceca6b0d34c53fd78f9c726b69217a4c4c

    Score
    10/10
    • Buer

      Buer is a new modular loader first seen in August 2019.

    • Buer Loader

      Detects Buer loader in memory or disk.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks