Extracted

• • Target

    Scrip.exe

  • Size

    192KB

  • MD5

    81cbb0338bea846c1163fc19b5a9c174

  • SHA1

    9a9ea1ff3704166d4b76838b17159987e30207e8

  • SHA256

    b6baee7c17b0c7603c639172e6ff9f642ce4508ba64afedf969a3608204c64e0

  • SHA512

    3bf7e26bcd46e80d026f5b2d6fab82fcae56a3e380d9a88f2ee876539037016467adffbd01043e20191b5e83687457a4ce936178bdc38a49e493f55656537ac8

  • SSDEEP

    3072:ObhQVe2GRs9ABW7z0QrTauJFFco5cAIp9BAVf2SR3b:HwFs9AsEQfC9jBAVfh

  Score

  10^/10

  buerloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2