Overview

overview

10

Static

static

8

Invoice106237.xls

windows7_x64

10

Invoice106237.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Invoice106237.xls

  • Size

    254KB

  • Sample

    210202-a3ywsl68re

  • MD5

    d99588c5238094b5c43ade66067fac80

  • SHA1

    9fba7c1073ab55f4f4373f9df4af60602b487560

  • SHA256

    dd6a316b8476993c98d452e05bae3441426cd074a165dab259183cfb64a7b23c

  • SHA512

    e23f46341bd206219522fbb18154d3d48b5835281b107d2dba215e985e08b210307ff3dd54a39724045ec5a7427a76c4985e920e68f7c12feff53673adea8a24

Score
10/10
buerloadermacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://goldforexinstitute.com/wp-admin/images/gif/faxer.txt

Extracted

Family

buer

C2

tokacpebanking.com

Targets

    • Target

      Invoice106237.xls

    • Size

      254KB

    • MD5

      d99588c5238094b5c43ade66067fac80

    • SHA1

      9fba7c1073ab55f4f4373f9df4af60602b487560

    • SHA256

      dd6a316b8476993c98d452e05bae3441426cd074a165dab259183cfb64a7b23c

    • SHA512

      e23f46341bd206219522fbb18154d3d48b5835281b107d2dba215e985e08b210307ff3dd54a39724045ec5a7427a76c4985e920e68f7c12feff53673adea8a24

    Score
    10/10
    buerloader

    • Buer

      Buer is a new modular loader first seen in August 2019.

      loaderbuer

    • Buer Loader

      Detects Buer loader in memory or disk.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks