Extracted

• • Target
    014a00ff4eb8eabdd9a7e2e0a0d322cfab2cd2a0f65855e98eef290b217d7c8f
  • Size 1.8MB
  • SHA256 014a00ff4eb8eabdd9a7e2e0a0d322cfab2cd2a0f65855e98eef290b217d7c8f
  • MD5 e91cc94bcf70a4cd3a8f8c7df1bf88fa
  • SHA1 2ac449ecfca9d525b8b65da6c47a5525c0fe48b9
  • SHA512 964dc41bbd55e571562f2c2d7f8c738efb1b31a9ff69d153d8e1af6c435080da65712641bbe7a69d5effff1a0defa20ebdf81670c7260ce3c5b590c09a4cb0c1
  • MD5 SHA1 SHA512

  Score

  10^/10

  buerevasionloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2