Extracted

• • Target

    560269fb9344b2ec68e2f78933eb1f0dcee04e688566cbb2213cb0c5fbbf281c

  • Size

    169KB

  • MD5

    3fdd3f9ed517441aaab8b67eb40211f5

  • SHA1

    e67303a8e18c7b45ca1b402d3d895785432fbd35

  • SHA256

    560269fb9344b2ec68e2f78933eb1f0dcee04e688566cbb2213cb0c5fbbf281c

  • SHA512

    20f88ecf5b9e8c6ffbaba836ac5b7f5ff260be1ce7d2069c6d30b138d15f7875882e4e23f860ce783a4e2eb8b2d9cbd9fc120c209e15ab874a57e0f1095f15c2

  Score

  10^/10

  buerloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2