Extracted

• • Target

    35ed64be314538c7a7a019331fe2c4faff7fd55c93f9a9bc5911cd705a60e90a

  • Size

    168KB

  • MD5

    a69ec18cd982181a5fbd2789663a88bf

  • SHA1

    7d44fdc6938916a54103169d1de0032ddeab0e35

  • SHA256

    35ed64be314538c7a7a019331fe2c4faff7fd55c93f9a9bc5911cd705a60e90a

  • SHA512

    f61baf6748f3c7a5da5e46693274e8d748699199c187a3dbb550747832fcade594f618ffbc5cbba5aa3848ec716ec8f2fb8267c8d2b15e9f63687ad1211f6900

  Score

  10^/10

  buerloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2