MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 615b9395be665d265953e69924b4df1808eda0fd40381d6d469bf4c362590125. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BuerLoader


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 615b9395be665d265953e69924b4df1808eda0fd40381d6d469bf4c362590125
SHA3-384 hash: b3caddc5955353a801c99aebbdaae3411cd97b261fc34b1cd007b12b3d25c6682910abbb626e38d88920cac1c1dd79dc
SHA1 hash: 145b3ed98ffe2ca15172dcabf52a76ecd33bd657
MD5 hash: b5ffd4ecdf7f1d4eb5f13a7207c5e4a5
humanhash: november-carpet-pizza-william
File name:b5ffd4ecdf7f1d4eb5f13a7207c5e4a5.exe
Download: download sample
Signature BuerLoader
Create hunting rule
File size:1'161'216 bytes
First seen:2020-05-25 16:05:18 UTC
Last seen:2020-06-10 12:26:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 910e2acbbfb5a7fd258eb2197be8eba5 (1 x BuerLoader)
ssdeep 12288:1gZc8daFvvMwxCU5fO6ntWXrhQp28CGwmUHjG2g8B+S9GzMD68Wj8n1S+kZeB+xL:mZ9ap4UvnerUjqHS2gW0zW3ce1gFogF
Threatray 33 similar samples on MalwareBazaar
TLSH FD35E0A1BBEC6578D25A7D303AAED93B179B6C11E8E545D1030CAAA32DF20631D1F50B
Reporter abuse_ch
Tags:BuerLoader exe


Avatar
abuse_ch
BuerLoader C2:
http://burload03.top/api/update/

Intelligence

File Origin
# of uploads :
3
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.878857.32634.21615.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Dealply
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 15:52:42 UTC
File Type:
PE (Exe)
Extracted files:
37
AV detection:
26 of 31 (83.87%)
Threat level:
  2/5
Verdict:
unknown
Similar samples:
01b44b9b3c3a6d3fc638b9a64e25ed866379539dddd9590290f71175352a9b23
BuerLoader
34e142c3ca75844c48639cfc8f60513d23c02a65addef3bce69f5b49b34277a1
BuerLoader
56af437f8b3b60b32b7cba77fa159138a777a48e98ce0215e8ec6f97ef12b223
BuerLoader
5b5eab7a12fdfc6cc39e39193b7a9020ee46e72acac70033236ef9b6b2da32c7
BuerLoader
77b2ce43a1a7363d6c90b9b11fc05220511a868f4f8ca72cd6cbe3219f79fbdd
BuerLoader
9dfc0d127c1129cd943b1c6ea494a01b40b6b29656db9a44f3dc3231db127a0e
BuerLoader
a6f6ee6214681cc7c2fcd82af2b0d8362600624e35a6d027b70787561b1f67d9
BuerLoader
b571436ef8d4284f5dabee122973c8710965a31de19f80f7a8a62cb8cea8f1d6
BuerLoader
baf5ce2b3e5d66b8a28c683d08d99fbc8d9bffa92a18a9ba2b07a90a04300314
BuerLoader
f4901daf97516f9a9b54233dd81810398de07db40d47072f37d90b4225387fd2
BuerLoader
+ 23 additional samples on MalwareBazaar
Result
Malware family:
buer
Create hunting rule
Score:
  10/10
Tags:
family:buer loader persistence vmprotect
Link:
https://tria.ge/reports/201109-yv12rnxz9a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates connected drives
Deletes itself
Loads dropped DLL
Executes dropped EXE
VMProtect packed file
Buer Loader
Modifies WinLogon for persistence
Buer
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

BuerLoader

Executable exe 615b9395be665d265953e69924b4df1808eda0fd40381d6d469bf4c362590125

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/368056/
  
Delivery method
Distributed via web download

Comments