Extracted

• • Target

    9431b3a7e09d260d61fd0363e29c865d092976f2695339a8e6152fa1f1db4fda

  • Size

    1.8MB

  • MD5

    329bd1008c63fa9abf81cd6afd7a6559

  • SHA1

    d07885a5899b13294672a3f396ec445dd8b09529

  • SHA256

    9431b3a7e09d260d61fd0363e29c865d092976f2695339a8e6152fa1f1db4fda

  • SHA512

    289f56d591ed7c542d0dec58a5d107713af35f2b50f1bb6ccc841c8114b833942d47c4c9da8061e750ccd1ab06649dfb4a039d6a658807c82a8e95b0afcaf78f

  Score

  10^/10

  buerevasionloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2