buer

General

Target
ea8358576152f09c0ea641691ec51e09_JaffaCakes118
Size 124KB
Sample240919-d6w1psyfrd
SHA256 54b7bba0fc0b998427ddd65c88fc8d5d5afe20304d043cd2831c6ca646bce0b0
MD5 ea8358576152f09c0ea641691ec51e09
SHA1 295076b9d5152fadd9a88b2933615e2d58b9f501
SHA512 39268cef0ae11605d357f5c6053bd1f50e169b8e704a76e71c0cec088362b16e3b8ead4c0ae5191618a22475727f1011549389132df74575e3c0190bc65f502b
SSDEEP 3072:Lf1BDZ0kVB67Duw9AMc+bEupgCJ6G8sl6E8j9MKZbEbOUuMaKESJNQ:L9X0Gg9p9ZD0MK2iUdM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

buer

C2

https://eternitydev.me/
https://masonkhonsari.me/

Targets

- Target
  ea8358576152f09c0ea641691ec51e09_JaffaCakes118
- Size 124KB
- SHA256 54b7bba0fc0b998427ddd65c88fc8d5d5afe20304d043cd2831c6ca646bce0b0
- MD5 ea8358576152f09c0ea641691ec51e09
- SHA1 295076b9d5152fadd9a88b2933615e2d58b9f501
- SHA512 39268cef0ae11605d357f5c6053bd1f50e169b8e704a76e71c0cec088362b16e3b8ead4c0ae5191618a22475727f1011549389132df74575e3c0190bc65f502b
- SSDEEP 3072:Lf1BDZ0kVB67Duw9AMc+bEupgCJ6G8sl6E8j9MKZbEbOUuMaKESJNQ:L9X0Gg9p9ZD0MK2iUdM
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

buer discovery loader persistence
- Buer
  Buer is a new modular loader first seen in August 2019.
  loader buer
- Modifies WinLogon for persistence
  persistence
- Buer Loader
  Detects Buer loader in memory or disk.
  loader
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
- MD5 fccff8cb7a1067e23fd2e2b63971a8e1
- SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
- SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
- SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  tmp.exe
- Size 120KB
- SHA256 44e5ab9cd8b8c02f5c28871cb59c5beb1106e4159e5d4b6aa591335e1b4c6b2f
- MD5 5c509d1af9a1e914c2f44f725b391afb
- SHA1 e53a38c381e40a02867d280a7363e8becca5a6c3
- SHA512 60dc5a4ac44dcc6ad5610c1358afd0d3c01d40d6ffce76b61034212c3c1d557ef91d76f756ceccc44dea7c7d00441296b6aa240954f40100dfecaa1aa95fcfe8
- SSDEEP 3072:G2A3MDSSCijJr/w0WGuTRGQaPgr5eBJoB2hNUMhTKJ:G2A8BrRuTRzeKMFKJ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

buer discovery loader persistence
- Buer
  Buer is a new modular loader first seen in August 2019.
  loader buer
- Modifies WinLogon for persistence
  persistence
- Buer Loader
  Detects Buer loader in memory or disk.
  loader
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6