Extracted

• • Target

    0807f543bc8322a5c55739c0a46aa8912feb5d3c8785b36188f9eb9e8b5e6af0

  • Size

    1.7MB

  • MD5

    3e397d12e8dc5a6194c6c275977f8bba

  • SHA1

    2aa3297e700208a43cad912c69aa5ff1f9435bce

  • SHA256

    0807f543bc8322a5c55739c0a46aa8912feb5d3c8785b36188f9eb9e8b5e6af0

  • SHA512

    6f0fba2a65073e0e8f526c4bfd0a24ae130a68c3f21b49595afc2bd4fd9c7d9f4661312f356011fae3ee626ffcb2ca364046e7fbc947f90d11719593a2ba9453

  Score

  10^/10

  buerevasionloader

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2