Extracted

• • Target

    db601f84fd39ba6be26e7a6c0cc1a74da424698244d9a1861b2f9fb980ab7dea_JC.exe

  • Size

    336KB

  • MD5

    987e0fb2e2e25e7587fc73ad83dcd096

  • SHA1

    8f84cdc64ff17e23cbc4f61cd37e3f7f4ec1b665

  • SHA256

    db601f84fd39ba6be26e7a6c0cc1a74da424698244d9a1861b2f9fb980ab7dea

  • SHA512

    41e544df2e12e0b195daab9ce2dce50d7067dca5f770950667ff3ca7aa2dfc4db4366528abeaccbb7712b8c24cc1f58eb73a2f0bd0852b586b8ba335e44ed37a

  • SSDEEP

    6144:1FyuHrjLvBSC+ct43OGIKRvpjkpluW2TKTBBzHF:pSChGIevpjT8fB

  Score

  10^/10

  buerloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2