Loading malware…
Buer Loader is a modular Windows malware loader first advertised on underground markets in August 2019. Sold as malware-as-a-service, it downloads and executes additional payloads and provides an initial foothold for subsequent intrusions. It has delivered Cobalt Strike, TrickBot, and Raccoon Stealer, and has enabled attack chains culminating in Ryuk and Conti ransomware. Distribution has been associated with TA800, TA578, and GOLD BLACKBURN, while initial access brokers have used infections to obtain access for resale to ransomware operators.
Buer Loader is commonly distributed through phishing and malicious spam using shipment, invoice, payroll, and COVID-19 lures. Infection chains have included macro-enabled Word and Excel documents, digitally signed Excel XLL add-ins, and Java-based attachments that retrieve and execute the loader. It has also appeared in malvertising campaigns using the Fallout exploit kit and in campaigns routed through compromised websites by the Prometheus traffic distribution system. Campaigns have affected organizations across multiple sectors, including healthcare, banking, and telecommunications, without exclusive industry targeting.
The loader profiles infected systems, collecting operating-system and architecture information, usernames, hostnames, privileges, storage details, and Active Directory domain information. It communicates with command-and-control infrastructure using HTTP or HTTPS, with encoded or encrypted messages. Its operator panel supports host monitoring, payload upload, task management, and conditional execution based on host characteristics. Persistence mechanisms include startup shortcuts and RunOnce entries. Anti-analysis measures include debugger and virtualization checks, process enumeration, execution delays, obfuscation, and encrypted payload reconstruction. Locale checks and geotargeting support avoidance of selected Commonwealth of Independent States systems.
Originally written in C, Buer Loader gained a Rust-based variant known as RustyBuer in 2021. RustyBuer retained the loader's core payload-delivery role and compatibility with its existing control infrastructure. Analyzed variants use a multistage design with encrypted, compressed payloads loaded into memory and additional anti-sandbox protections.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Buer Loader, detected by Trend Micro as Trojan.Win32.BUERLOADER, was first observed when it was advertised as a modular loader in August 2019. Since then, Buer Loader has continued its activity and shown signs of further development. Buer Loader's main function is to download and execute additional payloads.
In 2020, we observed the shift from TA800 distributing the Trick, with intermittent shifts to Buer Loader, and a consistent distribution of Bazaloader since April 2020.
TA578 uses email campaigns to deliver malware like Ursnif, IcedID, KPOT Stealer, Buer Loader, and BazaLoader, as well as Cobalt Strike.
"...allowing the document to execute print_document.exe —a malicious executable identified as Buer Loader."
28 distinct techniques documented for this family, organized by ATT&CK tactic.
A notable aspect of Buer Loader’s arrival is its use of malicious Microsoft Word and Microsoft Excel documents containing an embedded VBA macro that creates a process via WMI.
Further inspection of the command being executed by cmd.exe shows the full base64 command.
A notable aspect of Buer Loader’s arrival is its use of malicious Microsoft Word and Microsoft Excel documents containing an embedded VBA macro that creates a process via WMI.
the macro function itself is obfuscated using Hex-encoded strings that must be concatenated, reordered, and decoded.
The process tree of VMRay shows process injection via CreateRemoteThread from plugin.exe into secinit.exe.
After passing through this loop, we arrive at the decryption function of stage2... This data, once reconstituted, is placed in a buffer which is decrypted. We then recognize a Key Schedule type mechanism, followed by a generator reminiscent of RC4... The decompression is performed by the version 0.1.3 of the lzma-rs library.
It is observed that a signed XLL file delivers Buer Loader.
Once the processes have been enumerated, the malware proceeds to check for sandboxes and analysis tools.
A Rust crate ... is used to retrieve system information that is to be sent in an HTTP POST request to the C&C.
Another functionality that this loader contains is to enumerate processes or threads and query a list of all running processes by using CreateToolhelp32Snapshot and ProcessInformation.
These requests contain encrypted system information from the infected machine.
One such functionality is to query local or system time, or GetSystemTimeAsFileTime as seen in Figure 13.
Once the processes have been enumerated, the malware proceeds to check for sandboxes and analysis tools.
Part of Buer Loader’s service is to setup a domain to facilitate C&C.
With respect to infrastructure, the C&C functionality for Buer Loader is handled by HTTPS POST requests.
65 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Buer Loader is referenced as malware delivered via phishing to establish initial compromise in Ryuk-related attacks where SystemBC was later used.
A malware loader referenced as one of the payloads distributed by TA578.
Loader malware distributed by GOLD BLACKBURN.
A malware loader delivered via a spam email chain using a .jnlp attachment that downloads a JAR, which in turn retrieves and executes drvr32.exe. It establishes persistence via the Startup folder and a copy in %AppData%, performs anti-analysis checks for security/debugging DLLs, collects host information, encodes it in Base64, and communicates with a C2 over HTTP using GET to download additional malware and POST to exfiltrate victim machine details.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.