Brambul (4c057ade-6989-11e8-9efd-ab33ed427468)
Brambul malware is a malicious Windows 32-bit SMB worm that functions as a service dynamic link library file or a portable executable file often dropped and installed onto victims’ networks by dropper malware. When executed, the malware attempts to establish contact with victim systems and IP addresses on victims’ local subnets. If successful, the application attempts to gain unauthorized access via the SMB protocol (ports 139 and 445) by launching brute-force password attacks using a list of embedded passwords. Additionally, the malware generates random IP addresses for further attacks.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Brambul (d97ae60e-612a-4feb-908a-8c4d32e9d763) | Malpedia | Brambul (4c057ade-6989-11e8-9efd-ab33ed427468) | Tool | 1 |