Extracted

• • Target

    b8214a4193ab2e9ad46cc908789a17bc2c78cd4fa215b5311e7908caabb3ea6e

  • Size

    168KB

  • MD5

    3f703f81f4a4c842cdc0703a72c2b962

  • SHA1

    014c9705a2cb162435ed8f59990414c0d1c8bb68

  • SHA256

    b8214a4193ab2e9ad46cc908789a17bc2c78cd4fa215b5311e7908caabb3ea6e

  • SHA512

    ec266ae10cbbcc86581cb96d0fec1ecb0ef2cb76e13c116efde0adcdb11eb5943eb638f80d5ef39bfb0a070d9a8137bf03855820f758ea033109b9335db6a3ec

  Score

  10^/10

  buerloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2