Extracted

• • Target
    80e35297452f56d53068cfaa87d95cbb9af7f5a44c9db7b0a84f4a8ff83ebdaa
  • Size 2.5MB
  • SHA256 80e35297452f56d53068cfaa87d95cbb9af7f5a44c9db7b0a84f4a8ff83ebdaa
  • MD5 76195dea24952425594e7db7239ce0aa
  • SHA1 b9791aef3c83751b937f2b60fda094cecb8954a8
  • SHA512 0cdce90ccffcd69dcf5cc1ff8f0ecfc55f16227b2f6e1141f80c5dfe4dddec71db097755d47715cc59ea4f10ef5c72598eef252f87e923adbac212a27bd90727
  • MD5 SHA1 SHA512

  Score

  10^/10

  buerevasionloaderpersistencethemidatrojan

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2