Loading malware…
Buer Loader is a Windows malware loader offered as a criminal service since 2019 and used to download and execute follow-on payloads on compromised hosts. It has been widely observed in commodity malware and ransomware access chains, including delivery of Cobalt Strike and malware associated with TrickBot and Ryuk/Conti intrusion activity. Multiple criminal clusters have used it, including TA578, TA800, and operators linked to GOLD BLACKBURN, and it has also appeared in campaigns routed through traffic distribution systems such as Prometheus.
The malware is primarily distributed through email-based social engineering, commonly using malicious Word or Excel attachments with VBA macros, and later through signed Excel add-in files in XLL format. It has also been observed in malvertising activity via the Fallout exploit kit and in shipment- and COVID-19-themed spam campaigns. Typical infection chains use document or add-in execution to retrieve and launch the loader, after which Buer Loader profiles the host and contacts command-and-control infrastructure to obtain additional tasks or payloads.
Buer Loader supports host profiling and geotargeting, including collection of operating system, architecture, privilege, user, domain, and disk information, and it avoids execution or alters behavior on systems associated with CIS-region locales. Command-and-control traffic has been observed over HTTP and HTTPS, with encoded and encrypted beacon data using mechanisms including Base64, hex encoding, and RC4. The malware can self-update and is designed to support operator tasking through a control panel that manages infected hosts, payload delivery, execution conditions, and persistence options.
Persistence mechanisms include startup shortcut creation and RunOnce-based execution. Anti-analysis and defense-evasion features include debugger checks, sandbox and virtualization detection, long or CPU-intensive delays, obfuscation, and environment checks for analysis tooling and virtual machine processes. A Rust-rewritten variant, often called RustyBuer, emerged in 2021 while preserving core functionality and compatibility with existing operator infrastructure, likely to reduce effectiveness of detections built for earlier C-based samples.
Buer Loader has been associated with broad opportunistic campaigns as well as initial access preceding targeted ransomware intrusions. Reported victim concentrations have included healthcare, banking, and telecommunications organizations, and activity has been observed globally. Its role in the cybercrime ecosystem is primarily as an initial-access loader that enables later post-compromise operations by other malware or human operators.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Buer Loader, detected by Trend Micro as Trojan.Win32.BUERLOADER, was first observed when it was advertised as a modular loader in August 2019. Since then, Buer Loader has continued its activity and shown signs of further development. Buer Loader's main function is to download and execute additional payloads.
In 2020, we observed the shift from TA800 distributing the Trick, with intermittent shifts to Buer Loader, and a consistent distribution of Bazaloader since April 2020.
TA578 uses email campaigns to deliver malware like Ursnif, IcedID, KPOT Stealer, Buer Loader, and BazaLoader, as well as Cobalt Strike.
"...allowing the document to execute print_document.exe —a malicious executable identified as Buer Loader."
28 distinct techniques documented for this family, organized by ATT&CK tactic.
A notable aspect of Buer Loader’s arrival is its use of malicious Microsoft Word and Microsoft Excel documents containing an embedded VBA macro that creates a process via WMI.
Further inspection of the command being executed by cmd.exe shows the full base64 command.
A notable aspect of Buer Loader’s arrival is its use of malicious Microsoft Word and Microsoft Excel documents containing an embedded VBA macro that creates a process via WMI.
the macro function itself is obfuscated using Hex-encoded strings that must be concatenated, reordered, and decoded.
The process tree of VMRay shows process injection via CreateRemoteThread from plugin.exe into secinit.exe.
After passing through this loop, we arrive at the decryption function of stage2... This data, once reconstituted, is placed in a buffer which is decrypted. We then recognize a Key Schedule type mechanism, followed by a generator reminiscent of RC4... The decompression is performed by the version 0.1.3 of the lzma-rs library.
It is observed that a signed XLL file delivers Buer Loader.
Once the processes have been enumerated, the malware proceeds to check for sandboxes and analysis tools.
A Rust crate ... is used to retrieve system information that is to be sent in an HTTP POST request to the C&C.
Another functionality that this loader contains is to enumerate processes or threads and query a list of all running processes by using CreateToolhelp32Snapshot and ProcessInformation.
These requests contain encrypted system information from the infected machine.
One such functionality is to query local or system time, or GetSystemTimeAsFileTime as seen in Figure 13.
Once the processes have been enumerated, the malware proceeds to check for sandboxes and analysis tools.
Part of Buer Loader’s service is to setup a domain to facilitate C&C.
With respect to infrastructure, the C&C functionality for Buer Loader is handled by HTTPS POST requests.
65 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Buer Loader is referenced as malware delivered via phishing to establish initial compromise in Ryuk-related attacks where SystemBC was later used.
A malware loader referenced as one of the payloads distributed by TA578.
Loader malware distributed by GOLD BLACKBURN.
A malware loader delivered via a spam email chain using a .jnlp attachment that downloads a JAR, which in turn retrieves and executes drvr32.exe. It establishes persistence via the Startup folder and a copy in %AppData%, performs anti-analysis checks for security/debugging DLLs, collects host information, encodes it in Base64, and communicates with a C2 over HTTP using GET to download additional malware and POST to exfiltrate victim machine details.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.