Extracted

• • Target

    5ba2402e13843c844a0f2204aa72736f146cf1a8c9d1d569fa2379d21f86ef0f

  • Size

    1.7MB

  • MD5

    cd8e0ff55fdfb32912795718b6b1542f

  • SHA1

    ce9875fef041ebc5248eb41dfd3201ea4e5da76b

  • SHA256

    5ba2402e13843c844a0f2204aa72736f146cf1a8c9d1d569fa2379d21f86ef0f

  • SHA512

    4d36912e5ed28e037a5b63ffc95a50118c83ad244909a8e4e2c0d281bd1396903d2df6b0e48b4fd4f44d0a24f8b0e01f1d9b892c0ca591e98e7219351df10450

  Score

  10^/10

  buerevasionloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2