Extracted

• • Target
    e569998290b8e57cbfeea4f35425d6c79e4a6cf1bf56b316c01d8f91d269396f
  • Size 1.6MB
  • SHA256 e569998290b8e57cbfeea4f35425d6c79e4a6cf1bf56b316c01d8f91d269396f
  • MD5 362073a5ce3273ad4dcfc8e6c47ec3ca
  • SHA1 7948c767c9d666b4fd73d7b6180c5fd78c302ac1
  • SHA512 15d048fbb1ab5da75818a1ea21a1d7ed4f97b394281c677c7e7a08c1291cb514500ef3078ae358d1e1eb5c9bb294ebacf075f3b3b40631bce01c92d8f00c0377
  • MD5 SHA1 SHA512

  Score

  10^/10

  buerevasionloader

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2