General

  • Target

    Invoice.xls

  • Size

    254KB

  • Sample

    210202-wny6hscxfn

  • MD5

    32d28b4f61d985d50cf9beb53cee4ad7

  • SHA1

    e5abe4cfd0b9b23f7e3cf35a9df676d202d27887

  • SHA256

    030af453e0140f45b22c9e2fa1dc1441371e55455e4d207eaed78229800ff6b7

  • SHA512

    e446f74d80fb3b64b1666f92259e8ad5cdb810e97215520d747e8dd49cb884a6aaffd185e90f68a67fc37feab0b409c0f4b8c8cfbe680d6fd316ff5d8f228f8c

Score
10/10

Malware Config

Extracted

Family

buer

C2

tokacpebanking.com

Targets

    • Target

      Invoice.xls

    • Size

      254KB

    • MD5

      32d28b4f61d985d50cf9beb53cee4ad7

    • SHA1

      e5abe4cfd0b9b23f7e3cf35a9df676d202d27887

    • SHA256

      030af453e0140f45b22c9e2fa1dc1441371e55455e4d207eaed78229800ff6b7

    • SHA512

      e446f74d80fb3b64b1666f92259e8ad5cdb810e97215520d747e8dd49cb884a6aaffd185e90f68a67fc37feab0b409c0f4b8c8cfbe680d6fd316ff5d8f228f8c

    Score
    10/10
    • Buer

      Buer is a new modular loader first seen in August 2019.

    • Buer Loader

      Detects Buer loader in memory or disk.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks