Buer
Aliases: Buerloader, RustyBuer
- First seen
- 2019-08-01 00:00:00
- Malware type
- downloader, loader
- Family
- Malware family
- Last IoC activity
- 2026-07-18 17:16:47
- Profile updated
- 2026-07-07 12:54:55
Targeted industries: financial-services healthcare-and-pharmaceutical retail-and-hospitality technology-and-telecommunications
Context
Buer is a downloader sold on underground forums and used by threat actors to deliver payload malware onto target machines. It has been observed in email campaigns and has been sold as a service since August 2019.
Detection coverage
- 3 YARA rules
Detection rules
- CAPE_Buerloader (yara-rule)
- CAPE_Buerloader_1 (yara-rule)
- MALPEDIA_Win_Buer_Auto (yara-rule)
Reports & references
- secureworks.com — Gold Blackburn (report)
- secureworks.com — Gold Symphony (report)
- Trend Micro — Rpt Navigating New Frontiers Trend Micro 2021 Annual Cybersecurity Report (report)
- cisoclub.ru — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
- web.archive.org — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
- cronup.com — De Ataque Con Malware A Incidente De Ransomware (report)
- medium.com — Inside View Of Brazzzersff Infrastructure 89B9188Fd145 (report)
- zdnet.com — The Malware That Usually Installs Ransomware And You Need To Remove Right Away (report)
- trellix.com — Conti Leaks Examining The Panama Papers Of Ransomware (report)
- cert.ssi.gouv.fr — Certfr 2021 Cti 006 (report)
- blackberry.com — Report Old Dogs New Tricks (report)
- Trend Micro — Ssl Tls Technical Brief (report)
- marcoramilli.com — C2 Traffic Patterns Personal Notes (report)
- blog.group-ib.com — Prometheus Tds (report)
- research.checkpoint.com — Following The Scent Of Trickgate 6 Year Old Packer Used To Deploy The Most Wanted Malware (report)
- zscaler.com — Spear Phishing Campaign Delivers Buer And Bazar Malware (report)
- area1security.com — Trickbot Spear Phishing Drops Bazar Buer Malware (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Buer (report)
- labs.vipre.com — Buer Loader Found In An Unusual Email Attachment (report)
- twitter.com — 1182505434231398401 (report)
- twitter.com — 1321844306970251265 (report)
- Trend Micro — Technicalbrief An Analysis Of Buer Loader (report)
- Kaspersky — 96324 (report)
- news.sophos.com — Hacks For Sale Inside The Buer Loader Malware As A Service (report)
- proofpoint.com — Buer New Loader Emerges Underground Marketplace (report)