Extracted

• • Target

    6a57777ca59bc1e671ed7d78d6919e7a978eab31eb4f7ddd6d04d8d020a1fc9d

  • Size

    2.0MB

  • MD5

    abd4e9aad8ec61897613808a95b86a7a

  • SHA1

    d1962d200b9d79e5e9197050e7f1134c0bd1b22b

  • SHA256

    6a57777ca59bc1e671ed7d78d6919e7a978eab31eb4f7ddd6d04d8d020a1fc9d

  • SHA512

    42ca936d21a3995f7ba408915d1a9d20a1a5c18e19e4154755ac9e9c8ade80b90ca0daa487247dd3749301a59279864d67d5cd3b7e6c1aa3d7507c995c7edca3

  Score

  10^/10

  buerevasionloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2