Extracted

• • Target
    a1c86dc81df8c629410fa9970423016e_JaffaCakes118
  • Size 2.0MB
  • SHA256 4ffe3bdfc6fe67298681315b83cef2513ad95b9b3e3162b9a5e3a27c44f26fe1
  • MD5 a1c86dc81df8c629410fa9970423016e
  • SHA1 96bd00b2a79f00112e5f911019f140c95db19334
  • SHA512 250b3b28e3e0dd15bdf1bc6443d1a6570d8ff917800b9e4d99b6c0f2d76361a7c4ec0a1b92ba19f9fa0f01399783d587445ae4e95e22c5f1d7aab0413ffabd3f
  • SSDEEP 24576:f/y+xFOvI0vRcEg3QkQko24/NRwGi6oUrrke2RfhtTb8NO64tVaU/HpKINiC4tEr:C+xKFRM2Juf2OX6OftVaU/JNiNtE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  buerevasionloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Modifies WinLogon for persistence

    persistence

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2