Loading malware…
Buer Loader is a modular Windows malware loader first observed in 2019 and sold on underground forums as a malware-as-a-service offering. It is designed to establish an initial foothold on compromised systems and deliver follow-on payloads, including banking trojans, stealers, Cobalt Strike, SystemBC, and ransomware. Buer has been repeatedly linked to intrusion chains that culminated in Ryuk and later Conti-related activity, and it has also been used by crews associated with TrickBot. A Rust-based rewrite known as RustyBuer was later introduced, apparently to preserve compatibility with existing Buer infrastructure while improving evasion against detections focused on earlier C-based builds.
Buer is typically used as a first-stage downloader or loader rather than as the final payload. Its command-and-control model supports victim profiling, tasking, payload download and execution, and campaign management through a dedicated panel. Reported bot telemetry includes host identifiers, operating system and architecture details, processor count, privilege level, and computer name, enabling operators to filter and prioritize infections. Later development added enterprise-oriented host and domain profiling functionality and direct shellcode-loading support, allowing operators to deploy in-memory payloads such as Cobalt Strike without a separate stager.
The malware incorporates multiple anti-analysis and defense-evasion features, including debugger checks, virtual-machine detection, API hashing, and geofencing to avoid execution on systems in Commonwealth of Independent States countries. It has been observed using HTTPS-based command-and-control with encrypted tasking, surrogate-process execution, in-memory loading, and process injection. Persistence has been reported through mechanisms including RunOnce entries and startup shortcut creation, depending on the variant and campaign.
Observed delivery vectors include malicious macro-enabled Office documents in phishing and spearphishing campaigns, reply-chain email lures, cloud-hosted malicious documents, exploit-kit delivery through malvertising, and trojanized software distribution. Campaign themes have included shipping notices, payroll or tax lures, and fake business documents. In some operations, Buer served as an access broker platform, with operators apparently selling or transferring footholds to other criminal actors for later post-exploitation and ransomware deployment.
Buer has been associated with broad criminal targeting rather than a single vertical, but reporting shows impact across enterprise environments and use in campaigns affecting hundreds of organizations across dozens of sectors. Its role in ransomware precursor activity, modular design, and continued adaptation made it a notable loader in the Windows cybercrime ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
rule win_buer_auto { ... description = "Detects win.buer." ... malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buer" ... }
While analyzing the infrastructure, we discovered the Buer and Smoke loaders.
One of the crews involved in TrickBot has been utilizing Buer loader for sometime now to ultimately deliver CobaltStrike and ultimately leading to ransomware.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
According to Stern, Netwalker will use the TrickBot botnet to distribute their malware.
Figure 2: HTTP network traffic trace with the Fallout EK exploiting vulnerable browsers
The campaigns generally used DHL-themed phishing emails to distribute malicious Word or Excel documents.
Depending on the version, the registry entry will execute the malware directly or schedule a task to execute it.
The C2 functions are handled via HTTP(S) POST requests.
Upon launch, the Buer bot does a number of things to set up shop. The bot executes two sets of PowerShell commands...
They contained a link to a malicious Microsoft Word or Excel document download that used macros to drop the new malware variant.
Buer’s new functionality around loading shellcode as a task allowing for broader functionality against targets without the need for downloading a separate CobaltStrike stager.
Depending on the version, the registry entry will execute the malware directly or schedule a task to execute it.
The author also notes that the loader runs as a surrogate process of a trusted application
the injection into the surrogate process fails ... the loader will execute under its own process instead.
The payload of that malicious document was named print_document.exe. Like other Buer dropper samples we’ve analyzed, it was a digitally signed binary, using a stolen and now-revoked certificate issued by DigiCert.
The bot can be configured for execution either as a 32-bit Windows executable or as a DLL.
Checks for virtual machines using the Red Pill, No Pill, and related mechanisms
Checks locale to make sure the malware is not running in specific countries
Buer’s ‘DomainInfo’ component which is ultimately designed to profile some information about the infected system and the network that it is joined to.
The data gathered is constructed into a JSON blob listing ‘Id’, ‘Domains’, ‘Group’ and ‘Server’.
Checks for virtual machines using the Red Pill, No Pill, and related mechanisms
Checks locale to make sure the malware is not running in specific countries
50 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader used to gain initial access before SystemBC deployment.
The State of SSL/TLS Certificate Usage in Malware C&C Communications AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
A malware loader referenced as an alternative loader used or discussed by Conti personnel.
Buer is a malware-as-a-service loader/dropper used for initial compromise of Windows systems. It establishes a foothold, fingerprints victims, avoids CIS-region systems, contacts C2 over HTTP(S), can bypass PowerShell execution policy, adds Windows Defender exclusions, and downloads/deploys follow-on payloads such as Cobalt Strike that can enable later ransomware deployment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.