MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b2f8c43b4c92fb2add9fce264e92668dac2530493c51c5d6b45dcb764e208ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 15

Intelligence 15 IOCs YARA 4 File information Comments

SHA256 hash:	7b2f8c43b4c92fb2add9fce264e92668dac2530493c51c5d6b45dcb764e208ed
SHA3-384 hash:	207257959d38cdbb7c7f9a01eaa9da0786332af3b5dcd75f46468ae75464efd40f172b85c7f5582b256f574b57ea00a1
SHA1 hash:	010c623120a373b1a8e6d9339540e0cfe745b574
MD5 hash:	f024ff4176f0036f97ebc95decfd1d5e
humanhash:	lithium-oven-hamper-chicken
File name:	smb-7teux2sm.exe
Download:	download sample
File size:	57'344 bytes
First seen:	2025-04-21 03:12:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2b018f96d7cda0b915d2c1dcb16595c4
ssdeep	768:1W8+9FisiTNdzkHLCLTXnNuSGgJTPpfl6XWIWsyqA2g8/8WIjl2QDMrL4:1sisiT2LCLT3NuSvp5llTsyqDg8NIRd
TLSH	T13043AE13BCC094F2E45381B161DA9F3AD63710B552AA54C7DFA4CCA76D37071EA2E18B
TrID	45.7% (.EXE) Petite compressed Win32 executable (71530/12/14) 19.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 6.7% (.EXE) Win64 Executable (generic) (10522/11/4) 4.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Magika	pebin
Reporter	IndonesiaPeople
Tags:	Brambul Downloader exe trojan

Intelligence

File Origin

# of uploads :

# of downloads :

548

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

funnies.zip

Verdict:

Malicious activity

Analysis date:

2024-10-13 04:02:42 UTC

Tags:

arch-exec arch-doc scan smbscan webdav

Link:

https://app.any.run/tasks/8bf311d5-7a1b-4e44-a189-d71b66ab1c8e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/3193/

Detection(s):

PUA.Win.Packer.Petite-26

PUA.Win.Packer.Petite-29

Win.Spyware.78857-1

Win.Trojan.Agent-247414

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6805b880280f5f89a0d29c5e

Tags:

brambul dropper overt smtp

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

DNS request

Connection attempt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

brambul cmd entropy lolbin microsoft_visual_cc one packed packed packer_detected threat zero zusy

Link:

https://www.filescan.io/uploads/6805b7c490767142c3dcfe05/reports/42302a62-0e26-430d-ac78-61529b5b2d9f/overview

Verdict:

Malicious

Labled as:

Trojan.Brambul

Link:

https://www.hybrid-analysis.com/sample/7b2f8c43b4c92fb2add9fce264e92668dac2530493c51c5d6b45dcb764e208ed

Malware family:

Lazarus

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/da803c81-274b-444d-a69b-bcdb19614ff1

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/1670090

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to check if Internet connection is working

Contains functionality to detect sleep reduction / modifications

Contains functionality to enumerate network shares of other devices

Found stalling execution ending in API Sleep call

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Submitted sample is a known malware sample

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/7b2f8c43b4c92fb2add9fce264e92668dac2530493c51c5d6b45dcb764e208ed

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7b2f8c43b4c92fb2add9fce264e92668dac2530493c51c5d6b45dcb764e208ed/

Threat name:

Win32.Trojan.Brambul

Status:

Malicious

First seen:

2011-07-11 05:12:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

34 of 36 (94.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pmxyyq5uzex3floz7trgj2jgndnmeuyespcryxllixolozhcbdwq._file

Verdict:

malicious

Label(s):

brambul

Result

Malware family:

n/a

Score:

9/10

Tags:

discovery

Link:

https://tria.ge/reports/250421-dqsy4szwhw/

Behaviour

System Location Discovery: System Language Discovery

Creates a large amount of network flows

Contacts a large (10248) amount of remote hosts

Verdict:

Malicious

Tags:

Win.Spyware.78857-1

YARA:

n/a

Link:

https://app.threat.zone/submission/fa4c4858-6c8a-41d4-ab55-98194d7bf7ff

Unpacked files

SH256 hash:

7b2f8c43b4c92fb2add9fce264e92668dac2530493c51c5d6b45dcb764e208ed

MD5 hash:

f024ff4176f0036f97ebc95decfd1d5e

SHA1 hash:

010c623120a373b1a8e6d9339540e0cfe745b574

Detections:

win_brambul_auto

Link:

https://www.unpac.me/results/3fc7e588-3137-4981-b48d-323af4d363b3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7b2f8c43b4c92fb2add9fce264e92668dac2530493c51c5d6b45dcb764e208ed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Petite21 Create hunting rule
Author:	malware-lu

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	win_brambul_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.brambul.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 7b2f8c43b4c92fb2add9fce264e92668dac2530493c51c5d6b45dcb764e208ed

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/3193/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessA KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileA KERNEL32.dll::CreateFileA KERNEL32.dll::GetSystemDirectoryA
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::GetUserNameA
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegOpenKeyExA ADVAPI32.dll::RegSetValueExA
WIN_SVC_API	Can Manipulate Windows Services	ADVAPI32.dll::CreateServiceA ADVAPI32.dll::OpenSCManagerA ADVAPI32.dll::OpenServiceA ADVAPI32.dll::StartServiceA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample