Extracted

• • Target

    c97245effb055a3b948c2fb7120a47b944285982e5b46ce927f581df143fc594

  • Size

    202KB

  • MD5

    59db09162869f4770d65e6c8c483ae07

  • SHA1

    531e376bb4050e05c456873f6a60cdedac7ab3c8

  • SHA256

    c97245effb055a3b948c2fb7120a47b944285982e5b46ce927f581df143fc594

  • SHA512

    8365015158a74a847cec68fa64a3d30277b9a2eb6f24aef7594660e77eccbb28a2129b145166476c4ab081b75372d70326cbd250d99138d153346635ce481d44

  • SSDEEP

    3072:hR3e9hlpiO2qLs/OFERt5JX5M40jpF5s/Vr:69JiO2H/Ht5JimV

  Score

  10^/10

  buerstealcdiscoveryloaderspywarestealer

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1