MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85d4e3e3b7b8a330e04fe4a3a568f909b795e1c10fa824c49178462bead48d17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

BuerLoader

Vendor detections: 8

Intelligence 8 IOCs YARA 6 File information Comments

SHA256 hash:	85d4e3e3b7b8a330e04fe4a3a568f909b795e1c10fa824c49178462bead48d17
SHA3-384 hash:	ac6781307247eb5c62f00d9644d56f4a266cec976df97273adda82223bf9cfaf25bad82d221ee7148fa403771135a46e
SHA1 hash:	5fcf7c5bedb99fcc7edd7625c4b53eb1aa3c0267
MD5 hash:	3b814512f5c7b9618f9f6b9016f6b47e
humanhash:	sodium-stream-finch-cardinal
File name:	ZYDWv529R2h4111guEc.xlsm
Download:	download sample
Signature	BuerLoader Create hunting rule
File size:	489'551 bytes
First seen:	2020-12-01 09:14:19 UTC
Last seen:	2020-12-01 11:07:04 UTC
File type:	xlsm
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	6144:kdia7pURj7WvC9s7gQIdF/20bwbSvG4WSIUKy7CNtRX7gDNwI3DfFKgQ7JlZ:kneDbwbSvG4L7otRX7gDNwIzfFKg4Jz
TLSH	E3A4BFAB738BB34BDB6938790A8A494335F57F10346A2BF5E93BAA44D3E6117010D74C
Reporter	ffforward
Tags:	Buer xlsm

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
Base64	7_6	N182
Base64	C_6	Q182
Base64	G_6	R182
Base64	K_6	S182
Base64	O_6	T182
Base64	S_6	U182
Base64	W_6	V182
Base64	__6	X182
Base64	3_7	M183
Base64	7_7	N183
Base64	C_7	Q183
Base64	G_7	R183
Base64	K_7	S183
Base64	O_7	T183
Base64	S_7	U183
Base64	W_7	V183
Base64	__7	X183
Base64	3_8	M184
Base64	7_8	N184
Base64	C_8	Q184
Base64	G_8	R184
Base64	K_8	S184
Base64	O_8	T184
Base64	S_8	U184
Base64	W_8	V184
Base64	__8	X184
Base64	3_9	M185
Base64	7_9	N185
Base64	C_9	Q185
Base64	G_9	R185
Base64	K_9	S185
Base64	O_9	T185
Base64	S_9	U185
Base64	W_9	V185
Base64	__9	X185
Base64	3_t	M190
Base64	7_t	N190
Base64	C_t	Q190
Base64	G_t	R190
Base64	K_t	S190
Base64	O_t	T190
Base64	S_t	U190
Base64	W_t	V190
Base64	__t	X190
Base64	3_u	M191
Base64	7_u	N191
Base64	C_u	Q191
Base64	G_u	R191
Base64	K_u	S191
Base64	O_u	T191
Base64	S_u	U191
Base64	W_u	V191
Base64	__u	X191
Base64	3_v	M192
Base64	7_v	N192
Base64	C_v	Q192
Base64	G_v	R192
Base64	K_v	S192
Base64	O_v	T192
Base64	S_v	U192
Base64	W_v	V192
Base64	__v	X192
Base64	3_w	M193
Base64	7_w	N193
Base64	C_w	Q193
Base64	G_w	R193
Base64	K_w	S193
Base64	O_w	T193
Base64	S_w	U193
Base64	W_w	V193
Base64	__w	X193
Base64	3_x	M194
Base64	7_x	N194
Base64	C_x	Q194
Base64	G_x	R194
Base64	K_x	S194
Base64	O_x	T194
Base64	S_x	U194
Base64	W_x	V194
Base64	__x	X194
Base64	3_y	M195
Base64	7_y	N195
Base64	C_y	Q195
Base64	G_y	R195
Base64	K_y	S195
Base64	O_y	T195
Base64	S_y	U195
Base64	W_y	V195
Base64	__y	X195
Base64	3_z	M196
Base64	7_z	N196
Base64	C_z	Q196
Base64	G_z	R196
Base64	K_z	S196
Base64	O_z	T196
Base64	S_z	U196
Base64	W_z	V196
Base64	__z	X196
Base64	3m4	M200
Base64	7m4	N200
Base64	Cm4	Q200
Base64	Gm4	R200
Base64	Km4	S200
Base64	Om4	T200
Base64	Sm4	U200
Base64	Wm4	V200
Base64	_m4	X200
Base64	3m5	M201
Base64	7m5	N201
Base64	Cm5	Q201
Base64	Gm5	R201
Base64	Km5	S201
Base64	Om5	T201
Base64	Sm5	U201
Base64	Wm5	V201
Base64	_m5	X201
Base64	3m6	M202
Base64	7m6	N202
Base64	Cm6	Q202
Base64	Gm6	R202
Base64	Km6	S202
Base64	Om6	T202
Base64	Sm6	U202
Base64	Wm6	V202
Base64	_m6	X202
Base64	3m7	M203
Base64	7m7	N203
Base64	Cm7	Q203
Base64	Gm7	R203
Base64	Km7	S203
Base64	Om7	T203
Base64	Sm7	U203
Base64	Wm7	V203
Base64	_m7	X203
Base64	3m8	M204
Base64	7m8	N204
Base64	Cm8	Q204
Base64	Gm8	R204
Base64	Km8	S204
Base64	Om8	T204
Base64	Sm8	U204
Base64	Wm8	V204
Base64	_m8	X204
Base64	3m9	M205
Base64	7m9	N205
Base64	Cm9	Q205
Base64	Gm9	R205
Base64	Km9	S205
Base64	Om9	T205
Base64	Sm9	U205
Base64	Wm9	V205
Base64	_m9	X205
Base64	3mt	M210
Base64	7mt	N210
Base64	Cmt	Q210
Base64	Gmt	R210
Base64	Kmt	S210
Base64	Omt	T210
Base64	Smt	U210
Base64	Wmt	V210
Base64	_mt	X210
Base64	3mu	M211
Base64	7mu	N211
Base64	Cmu	Q211
Base64	Gmu	R211
Base64	Kmu	S211
Base64	Omu	T211
Base64	Smu	U211
Base64	Wmu	V211
Base64	_mu	X211
Base64	3mv	M212
Base64	7mv	N212
Base64	Cmv	Q212
Base64	Gmv	R212
Base64	Kmv	S212
Base64	Omv	T212
Base64	Smv	U212
Base64	Wmv	V212
Base64	_mv	X212
Base64	3mw	M213
Base64	7mw	N213
Base64	Cmw	Q213
Base64	Gmw	R213
Base64	Kmw	S213
Base64	Omw	T213
Base64	Smw	U213
Base64	Wmw	V213
Base64	_mw	X213
Base64	3mx	M214
Base64	7mx	N214
Base64	Cmx	Q214
Base64	Gmx	R214
Base64	Kmx	S214
Base64	Omx	T214
Base64	Smx	U214
Base64	Wmx	V214
Base64	_mx	X214
Base64	3my	M215
Base64	7my	N215
Base64	Cmy	Q215
Base64	Gmy	R215
Base64	Kmy	S215
Base64	Omy	T215
Base64	Smy	U215
Base64	Wmy	V215
Base64	_my	X215
Base64	3mz	M216
Base64	7mz	N216
Base64	Cmz	Q216
Base64	Gmz	R216
Base64	Kmz	S216
Base64	Omz	T216
Base64	Smz	U216
Base64	Wmz	V216
Base64	_mz	X216
Base64	3n4	M240
Base64	7n4	N240
Base64	Cn4	Q240
Base64	Gn4	R240
Base64	Kn4	S240
Base64	On4	T240
Base64	Sn4	U240
Base64	Wn4	V240
Base64	3_4	M180
Base64	7_4	N180
Base64	C_4	Q180
Base64	G_4	R180
Base64	K_4	S180
Base64	O_4	T180
Base64	S_4	U180
Base64	W_4	V180
Base64	__4	X180
Base64	3_5	M181
Base64	7_5	N181
Base64	C_5	Q181
Base64	G_5	R181
Base64	K_5	S181
Base64	O_5	T181
Base64	S_5	U181
Base64	W_5	V181
Base64	__5	X181
Base64	3_6	M182
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

155

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

TwinWave.EvilDoc.QakisWackWannaDanceWithSomebody.20201119.UNOFFICIAL

TwinWave.EvilDoc.QakisWackWannaDanceWithSomebody.M2.20201119.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching the default Windows debugger (dwwin.exe)

Launching a process by exploiting the app vulnerability

Result

Verdict:

Malicious

File Type:

OOXML Excel File with Excel4Macro

Link:

https://app.docguard.net/85d4e3e3b7b8a330e04fe4a3a568f909b795e1c10fa824c49178462bead48d17/results/dashboard

Payload URLs

URL

File name

http://149.3.170.235/qw-fad/host.exe

sharedStrings.xml

Document image

Image:

Download PNG

Result

Verdict:

MALICIOUS

Details

IPv4 Dotted Quad URL

A URL was detected referencing a direct IP address, as opposed to a domain name.

Macro Execution Coercion

Detected a document that appears to social engineer the user into activating embedded logic.

Autostarting Excel Macro Sheet

Excel contains Macrosheet logic that will trigger automatically upon document open.

Document With No Content

Document contains little or no semantic information.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/85d4e3e3b7b8a330e04fe4a3a568f909b795e1c10fa824c49178462bead48d17/

Threat name:

Document-Office.Downloader.SLoad

Status:

Malicious

First seen:

2020-12-01 09:15:09 UTC

AV detection:

10 of 28 (35.71%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qxkohy5xxcrtbycp4sr2k2hzbg3zlyobb6ucjrerpbdcx2wurulq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/201201-rvx851wwas/

Behaviour

Enumerates system info in registry

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks processor information in registry

NSIS installer

Suspicious use of SetThreadContext

Loads dropped DLL

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.50

Link:

https://yomi.yoroi.company/submissions/85d4e3e3b7b8a330e04fe4a3a568f909b795e1c10fa824c49178462bead48d17

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	IPPort_combo_mem Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	Microsoft_XLSX_with_Macrosheet Create hunting rule

Rule name:	Select_from_enumeration Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	SharedStrings Create hunting rule
Author:	Katie Kleemola
Description:	Internal names found in LURK0/CCTV0 samples

Rule name:	UAC_bypass_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

BuerLoader

xlsm 85d4e3e3b7b8a330e04fe4a3a568f909b795e1c10fa824c49178462bead48d17

(this sample)

Joe Sandbox

https://www.joesandbox.com/analysis/325082/1/html

Delivery method

Distributed via e-mail attachment

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample