MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BuerLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac
SHA3-384 hash: c87a44feeb6fa05734878077bfd0f33c1818b6549f72202c330b9fcb5773fd13653b3f1b5b37a8b1c3b02c524f681e64
SHA1 hash: a61e74e58d3c5eee4a127dd108cff9dbbcfc8ef1
MD5 hash: 65d160b89f6f563bca60461adc71f979
humanhash: lamp-bluebird-pip-bluebird
File name:officeverifysign[1].exe
Download: download sample
Signature BuerLoader
Create hunting rule
File size:1'549'932 bytes
First seen:2021-05-15 05:53:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e9c0657252137ac61c1eeeba4c021000 (53 x GuLoader, 26 x RedLineStealer, 17 x AgentTesla)
ssdeep 24576:cRGTl08SERfOVXuwPjCO47i4QhPMMBxzLic2VKJz16To2Dv4et08wRYB7PAe:cMFls6Omi4QTHLic0kOowd
Threatray 8 similar samples on MalwareBazaar
TLSH 507523913340D6E7D5B70774C473F330ABB5AE913E38894B724069EB9A7482D8E1F926
Reporter Anonymous
Tags:BuerLoader rustybuer

Intelligence

File Origin
# of uploads :
1
# of downloads :
226
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b.exe
Verdict:
Malicious activity
Analysis date:
2021-05-03 16:13:58 UTC
Tags:
loader buerloader
Link:
https://app.any.run/tasks/c3c98159-e7aa-440c-a768-ba55617ba1ba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/157296/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Creating a file in the %AppData% directory
Creating a file in the %temp% subdirectories
DNS request
Sending a UDP request
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/782689
Signature
Contains functionality to behave differently if execute on a Russian/Kazak computer
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
buerloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac/
Threat name:
Win32.Trojan.BuerLoader
Create hunting rule
Status:
Malicious
First seen:
2021-04-19 21:03:04 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hk7nq32gzc7hkqrz7dehr4bv56voshbtxdvyqggfxpwzrrgzuowa._file
Verdict:
unknown
Similar samples:
38cc20967d2c0a54f1c967b22bafdc20936ebb45d236f1a3ebcb24d2c48a2fb6
BuerLoader
483ce500c97e69b9937400f16c2cbf2cdd56017020051456efc24137f03f2579
BuerLoader
754ab7c2050696e0d2010dc98f8138f6634abd10b8089a0b5bde2453a61d98bb
BuerLoader
7bc840f3e200c5c877b411614a96a364f5402060db380a7691aeaabff18b602c
BuerLoader
904f69a4bed3844273cce1676e8920794815af4c1527e560bbc1bc44b5b8457a
BuerLoader
96e08603df95e9e47877cc3ff2c3a02c68579acc8ebc703f726032a9b786a7f4
BuerLoader
c036d1c05516a8df5ea47b37cf51676e02f06ddc69532b600e3a9e1e50da3de2
BuerLoader
e0fb60da371912c158861c9660632d58e45cfcff12351cc9e03f497f319eb5de
BuerLoader
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210515-2lmswccpae/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Enumerates connected drives
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.97
Link:
https://yomi.yoroi.company/submissions/3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win_rustybuer_a0
Create hunting rule
Author:Rony (@r0ny_123)
Description:Detects unpacked buer written in rust
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/157296/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-15 05:59:27 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
1) [C0032.001] Data Micro-objective::CRC32::Checksum
2) [C0026.002] Data Micro-objective::XOR::Encode Data
5) [C0045] File System Micro-objective::Copy File
6) [C0046] File System Micro-objective::Create Directory
7) [C0048] File System Micro-objective::Delete Directory
8) [C0047] File System Micro-objective::Delete File
9) [C0049] File System Micro-objective::Get File Attributes
10) [C0051] File System Micro-objective::Read File
11) [C0050] File System Micro-objective::Set File Attributes
12) [C0052] File System Micro-objective::Writes File
13) [E1510] Impact::Clipboard Modification
14) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
15) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
16) [C0036.002] Operating System Micro-objective::Delete Registry Key::Registry
17) [C0036.007] Operating System Micro-objective::Delete Registry Value::Registry
18) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
19) [C0036.005] Operating System Micro-objective::Query Registry Key::Registry
20) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
21) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
22) [C0017] Process Micro-objective::Create Process
23) [C0038] Process Micro-objective::Create Thread
24) [C0018] Process Micro-objective::Terminate Process