Extracted

• • Target

    82ce2fc01d4010cae7934b6069626dc80e8d593b0cfd73f2f748ce56754a897f

  • Size

    202KB

  • MD5

    fce17f18a0524f4666e8259dc28f0ddf

  • SHA1

    264d92b4a5220e1175b7e1be83bb51315afc9c2d

  • SHA256

    82ce2fc01d4010cae7934b6069626dc80e8d593b0cfd73f2f748ce56754a897f

  • SHA512

    852c451326767d5c1d73fb7f36ff5f89756ddc0add5661f93cf1efd0b1ec71305f2fb4a71239baed22001d24cd7a823f4ab8c660bc89e22fed5cb993a22bac88

  • SSDEEP

    3072:CANnk671r1RbKzEzPfB+WhOKPu8v9ZQ4xUdAJIWH5xW6zReL6X:Cank6J1RVznoL8v9Zh2AJZTteQ

  Score

  10^/10

  buerstealcdiscoveryloaderspywarestealer

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2