Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BrushaLoader is one of a growing group of downloaders frequently employed by threat actors to profile infected PCs and then load more robust payloads on devices of interest.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
This code is responsible for establishing a remote, interactive session with the infected system that is then used to execute commands on the infected system retrieve the command output.
One of the most significant changes in this campaign was the move toward PowerShell and away from wscript that was previously used to execute commands, gather system information, and provide additional payloads.
Brushaloader also leverages a combination of VBScript and PowerShell to create a Remote Access Trojan (RAT) that allows persistent command execution on infected systems.
As can be seen in the screenshot above, the loader attempts to enumerate the following information about systems being infected: ProcessorId Windows operating system version Currently logged in Username Installed Antivirus Products System Make/Manufacturer Powershell version IP address information Available memory Current Working Directory System Installation Date/Time Display Adapter Information
Figure 2: HTTP portion of BrushaLoader delivery and post-infection activity...
First is the adversaries have moved to HTTPS traffic and are utilizing a domain instead of a hard-coded IP. Additionally, the type of request has changed from a GET to a POST.
93 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader malware mentioned as potentially connected/related to SystemBC (relationship not fully detailed in the content).
A VisualBasic/JavaScript/PowerShell loader/downloader used to fingerprint infected systems via PowerEnum and then deliver secondary payloads. It is used in multiple campaigns across geographies and can deliver banking trojans and other malware, and potentially ransomware as secondary payloads.
A VBScript- and PowerShell-based malware loader that delivers additional payloads, establishes persistent remote command execution, performs anti-analysis and sandbox-evasion checks, gathers host reconnaissance data, and maintains persistence via Startup LNK and registry-stored PowerShell.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.