Overview

overview

10

Static

static

1

file.exe

windows7-x64

8

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file

  • Size

    348KB

  • Sample

    230210-ka2dwach34

  • MD5

    d14a89e4a2604df158396b55e4af9c20

  • SHA1

    f06e0c41bdda1010767e23279fc493f3d6c748ea

  • SHA256

    c75e381fd3f06dfa11fb2c1eaccb9aa26a1b4372f68bb325b3dfa7dc006ab6e2

  • SHA512

    5174b1cb59f0ecf1b74915031ab4cb77a498d985231e5b62d4256fcb998948a0095e3e48b3df7c8fc01d8b45de0f573611816b3f88724472714946f714cedc04

  • SSDEEP

    3072:QS0RJDZOg8St0MfmVnUj7TyW9PhKSbC9P3rUiFoe9nf6N3pUUV:FUtOA0nVnw7T95WZwgo0nfW3

Score
10/10
buerdiscoveryloaderpersistencespywarestealer

Malware Config

Targets

    • Target

      file

    • Size

      348KB

    • MD5

      d14a89e4a2604df158396b55e4af9c20

    • SHA1

      f06e0c41bdda1010767e23279fc493f3d6c748ea

    • SHA256

      c75e381fd3f06dfa11fb2c1eaccb9aa26a1b4372f68bb325b3dfa7dc006ab6e2

    • SHA512

      5174b1cb59f0ecf1b74915031ab4cb77a498d985231e5b62d4256fcb998948a0095e3e48b3df7c8fc01d8b45de0f573611816b3f88724472714946f714cedc04

    • SSDEEP

      3072:QS0RJDZOg8St0MfmVnUj7TyW9PhKSbC9P3rUiFoe9nf6N3pUUV:FUtOA0nVnw7T95WZwgo0nfW3

    Score
    10/10
    discoverypersistencespywarestealerbuerloader

    • Buer

      Buer is a new modular loader first seen in August 2019.

      loaderbuer

    • Downloads MZ/PE file

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks