Extracted

• • Target

    2e12043576f00278e8e1207709477d00c5e750fe42ebbae261302df924fb92fa

  • Size

    1.6MB

  • MD5

    f0120868b013fa572bad5ceb3d50798d

  • SHA1

    8ccd636f9852a713e9c0aff7f2cfba667ad95247

  • SHA256

    2e12043576f00278e8e1207709477d00c5e750fe42ebbae261302df924fb92fa

  • SHA512

    5c45d2834bfb3a57d98ff85142f4fe9675c8bbcebaf40859cd1e93b81c3a5e429531c71527b9d667ee8a2ad561a98b47980a098c69fbb564fe39b0ef6fda25d6

  Score

  10^/10

  buerevasionloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2