Extracted

• • Target

    d2930279448fd7ae1432dfe5d1de37c9e5c924e5466ab49763e8de671b24c511

  • Size

    1.6MB

  • MD5

    27eff943a9a321407709d92ef5f99667

  • SHA1

    1c6a9de56ae6db79d1ade91876baeda42c0d3819

  • SHA256

    d2930279448fd7ae1432dfe5d1de37c9e5c924e5466ab49763e8de671b24c511

  • SHA512

    f43a9781e3148105682237897682dd8f289fb4cbb1f21e4e329ece0d04ee0f903a6f664cd7fa5a3d9ccdcbfe96ba37e5d79e909fc84b12ba426dcf03024590f3

  Score

  10^/10

  buerevasionloader

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2