Extracted

• • Target

    0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f

  • Size

    1.9MB

  • MD5

    73461127ecd53340878c5c8dd558cacb

  • SHA1

    4efb8f4f888fed27a1866118739fb4b3e7dcbd0e

  • SHA256

    0dd7e132fb5e9dd241ae103110d085bc4d1ef7396ca6c84a3b91dc44f3aff50f

  • SHA512

    2a7eb7a92bda07637631356faf6d9357cf3393c119cf663f3c9d31ec8c64c53e67801bd0c26004a973346e98a47a4f75e711899cf1c1b142a50df00306b9d390

  Score

  10^/10

  buerevasionloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2