Extracted

• • Target

    1b1f3cf5a07eda43fab214b026b2431baec1cf9632d3c0017e8555e87cd0f676

  • Size

    1.6MB

  • MD5

    1518649e83f4c956ce199824aab84edd

  • SHA1

    22e1c529f39cef4ea6e266323fb4a0d620be9cd1

  • SHA256

    1b1f3cf5a07eda43fab214b026b2431baec1cf9632d3c0017e8555e87cd0f676

  • SHA512

    595f4ebb9a78672e29b42429b8cf31055f3af2393640aa41ae2766947406005a82267eba33c99ad8f7b5c71bc4a3cf10d890981c27cbffb2f9893e2c08147ed2

  Score

  10^/10

  buerevasionloader

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2