Overview

overview

8

Static

static

brambora.exe

windows7-x64

8

brambora.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    brambora.exe

  • Size

    2.5MB

  • Sample

    221226-xe81qsgf5v

  • MD5

    4c228320a55925b54cb95a819e616617

  • SHA1

    789cfe26cde0f3fba7393e13a60a0c2ac2892daa

  • SHA256

    04b6c9cdb32d4eb3a97b9fbcf8d31cd6c96c701dc987bd4af70ff7f408a1d591

  • SHA512

    21131eada4166f2c1a15cd527d124101232d80dac3f838f510b70b9bd22446b4781b8e83dd6163bbc53acb916f6d40f710752b34c827aa50769e52dc49fa9583

  • SSDEEP

    24576:57xYpbZTDbuOnyainCmKjj5e4jSJZ6yY+Ec0xMkl81sU3AoJpoEUOgYMe:57UbZTDbu7ainCmlJo+poEUOgYMe

Score
8/10
evasionpersistence

Malware Config

Targets

    • Target

      brambora.exe

    • Size

      2.5MB

    • MD5

      4c228320a55925b54cb95a819e616617

    • SHA1

      789cfe26cde0f3fba7393e13a60a0c2ac2892daa

    • SHA256

      04b6c9cdb32d4eb3a97b9fbcf8d31cd6c96c701dc987bd4af70ff7f408a1d591

    • SHA512

      21131eada4166f2c1a15cd527d124101232d80dac3f838f510b70b9bd22446b4781b8e83dd6163bbc53acb916f6d40f710752b34c827aa50769e52dc49fa9583

    • SSDEEP

      24576:57xYpbZTDbuOnyainCmKjj5e4jSJZ6yY+Ec0xMkl81sU3AoJpoEUOgYMe:57UbZTDbu7ainCmlJo+poEUOgYMe

    Score
    8/10
    evasionpersistence

    • Executes dropped EXE

    • Looks for VMWare Tools registry key

      evasion

    • Registers COM server for autorun

      persistence

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks