Jump to content
 







Main menu
   


Navigation  



Main page
Contents
Current events
Random article
About Wikipedia
Contact us
Donate
 




Contribute  



Help
Learn to edit
Community portal
Recent changes
Upload file
 








Search  

































Create account

Log in
 









Create account
 Log in
 




Pages for logged out editors learn more  



Contributions
Talk
 



















Contents

   



(Top)
 


1 History  



1.1  Sony hack (Late 2014)  





1.2  Investigation (Early 2019)  







2 Cycle  



2.1  System drive share  







3 References  





4 External links  














Brambul







Add links
 









Article
Talk
 

















Read
Edit
View history
 








Tools
   


Actions  



Read
Edit
View history
 




General  



What links here
Related changes
Upload file
Special pages
Permanent link
Page information
Cite this page
Get shortened URL
Download QR code
Wikidata item
 




Print/export  



Download as PDF
Printable version
 
















Appearance
   

 






From Wikipedia, the free encyclopedia
 


Brambul
Technical name
TypeComputer worm
AuthorsLazarus
Technical details
PlatformWindows XP
Written inKorean

Brambul is an SMB protocol computer worm that decrypts[clarification needed] and automatically moves from one computer to its second computer.

It is responsible for the dropping of the Joanap botnet.

History

[edit]

Brambul was first discovered in 2009 and has not had a disclosure prior to its notoriety. It was observed by cybersecurity firms and was not extensive subject.[4]

Sony hack (Late 2014)

[edit]

Brambul was among the malware to be identified during the Sony Pictures hack.

Investigation (Early 2019)

[edit]

Brambul as well as Joanap botnet have both been shut down via a court order.

Cycle

[edit]

The computer worm has the ability to automatically scan IP addresses and decrypt passwords including, but not limited to the following.[1]

Password Description
password The word password
!@#$% 1-5 typed with the shift key
!@#$%^&*() all ten number keys typed with the shift key
~!@#$%^&*()_+ the entire top row of keys typed with the shift key

System drive share

[edit]

Brambul will share information of the system to the cyberattacker. Information shared includes the IP address, hostname and the username and password.[5]

References

[edit]
  1. ^ a b "W32.Brambul". Symantec. Archived from the original on May 31, 2018.
  • ^ "Win32/Brambul threat description - Microsoft Security Intelligence". www.microsoft.com.
  • ^ "Trojan:Win32/Brambul.A threat description - Microsoft Security Intelligence". www.microsoft.com.
  • ^ "Hidden Cobra Strikes Again with Custom RAT, SMB Malware". threatpost.com.
  • ^ at 01:58, Simon Sharwood 30 May 2018. "FBI fingers North Korea for two malware strains". www.theregister.co.uk.{{cite web}}: CS1 maint: numeric names: authors list (link)
  • [edit]
    Retrieved from "https://en.wikipedia.org/w/index.php?title=Brambul&oldid=1221433228"

    Categories: 
    Computer worms
    2014 in computing
    Hidden categories: 
    CS1 maint: numeric names: authors list
    Articles with short description
    Short description matches Wikidata
    Wikipedia articles needing clarification from August 2019
     



    This page was last edited on 29 April 2024, at 22:38 (UTC).

    Text is available under the Creative Commons Attribution-ShareAlike License 4.0; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.



    Privacy policy

    About Wikipedia

    Disclaimers

    Contact Wikipedia

    Code of Conduct

    Developers

    Statistics

    Cookie statement

    Mobile view



    Wikimedia Foundation
    Powered by MediaWiki