Extracted

• • Target

    ca8f4594a6800a308c5cbc8c6325e958e42dd4cf539ad4e01362dcc1ec20142b

  • Size

    1.5MB

  • MD5

    6943e6fa21cf64f70bccdf137160b9ca

  • SHA1

    e0d5fe545d1d17dd1e06f21b6767fb2a20df2e86

  • SHA256

    ca8f4594a6800a308c5cbc8c6325e958e42dd4cf539ad4e01362dcc1ec20142b

  • SHA512

    6e83cb6001bcca7f7376f80e215671a0210e8fc5670a28d7b8373b02d831d3c7b4adaab85b5596d5d7ebe89fce2f75975d6e9a5446f0cf05d0c6d2c50b50d99a

  Score

  10^/10

  buerevasionloader

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2