Extracted

• • Target

    fc3c68e9d36d703376fb466cc0126e5bedddda08170a2b41d297ff6dd5cfc23b

  • Size

    1.6MB

  • MD5

    3c9c8fd4ce120ff1b2e7bf1b5d6a2dd3

  • SHA1

    73fdcf58ecee325c35e9904ddd88508cd539251a

  • SHA256

    fc3c68e9d36d703376fb466cc0126e5bedddda08170a2b41d297ff6dd5cfc23b

  • SHA512

    00a2cf1592f6e8f7135187691506ff03d61e3d36f34db800b7baeac566b960d798f03d567fd7b71787e7770a6b98c3bee718aa5bab0a7d63df1ad68d1e6b9ded

  Score

  10^/10

  buerevasionloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2