BuerMalware
- buerloader
- rustybuer
Buer is a downloader sold on underground forums and used by threat actors to deliver payload malware onto target machines. It has been observed in email campaigns and has been sold as a service since August 2019.From MISP Galaxy
Last reported 5 years ago, by Group-IB3 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“… we have shown throughout the article, to execute payloads GrimAgent uses both the ShellExecute call and indirect execution through scheduled tasks.”
- T1056.001Keylogging
“Keylogging”
- T1505.003Web Shell
“The list is uploaded through importing links to web shells.”
- T1552.004Private Keys
“Generated client RSA public and private keys: Both stored at the config file.”
- T1684Social Engineering
“…r of the service claimed that Prometheus TDS is an ANTIBOT redirect system designed to send out emails, work with traffic, and for social engineering.”
What the reports say
3 reports, newest first · the exact sentence from each-
Prometheus TDS“…oup-IB’s analysts indicates that a similar pattern is also used to distribute malware such as Campo Loader, IcedID, QBot, SocGholish, and Buer Loader.”
-
The Brothers Grim“…s Threat Intelligence & Attribution system, Ryuk operators used different commodity malware over time (including Emotet, TrickBot, Bazar, Buer, and SilentNight) to deploy ransomware.”
-
The footprints of Raccoon“While analyzing the infrastructure, we discovered the Buer and Smoke loaders.”
Indicators in its reports
named in the reports above- 03ec9000b493c716…88c6a1c65ce5in 1 report
- 015e5a1fa9d8151ee51d6e53e187fbb2in 1 report
- 163917ced2d1b330…ec3ea871d517in 1 report
- 63bd614434a70599…a3c4b4db5cafin 1 report
- hxxps://github[.]com/apriegob/GrimAgent/blob/main/IDAPro/IDAPro_string_decryptor.pyin 1 report
- d6ee553f52f20127…73144ef2354din 1 report
- hxxp://ip-api[.]com/csv/?fields=query,countryCodein 1 report
- microsoftupdate[.]topin 1 report
- microsoftsystemcloud[.]comin 1 report
- chaseltd[.]topin 1 report
- co[.]zain 1 report
- documents-cloud-server.co[.]zain 1 report
- b1799345152f0f11…a1867d64e119in 1 report
- hxxp://cloudupdate.co[.]za/documents/msofficeupdate.exein 1 report
- cloudupdate.co[.]zain 1 report
- f3498ba783b9c8c8…d2ff189615d9in 1 report
- badlandsparks[.]comin 1 report
- 185.244.149[.]100in 1 report
- 13b7afe8ee87977a…ca7efd62b9b6in 1 report
- 596a3cb4d82e6ab4…14b0f7bd14afin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.