> Family · brooter_

~/packetpursuit $ cat /intel/families/brooter.md

typeentityconfidencehighcreated2026-06-28updated2026-06-28delphibrute-forcecredential-stuffingsocial-engineeringpedefense-evasion

brooter

A Russian-language Delphi VCL GUI brute-forcing / credential-stuffing tool distributed under social-engineering filenames. Not a trojan, RAT, or infostealer — the threat is purely in the distribution vector and the unauthorized use against third-party services.

Overview

Brooter is a standalone Windows GUI application built in Delphi 7-era Object Pascal with the Visual Component Library (VCL). The name is Russian slang derived from "brute force" (брутфорс → брут → брутер). It presents a form-based interface for launching dictionary or list-based credential-stuffing attacks against web login forms, with configurable thread count and color-coded result counters.

Attribute Value
First observed 2026-05-26 (MalwareBazaar submission)
Build language Russian (CP1251 UI strings)
Tool type Account brute-forcer / credential stuffer
Compiler Delphi 7 / CodeGear (Borland)
Framework VCL Forms with FastMM4 memory manager
Contact ICQ UIN 322322032 (hardcoded in form caption)
Distribution Social-engineering double-extension masquerade

Build Stack

  • Compiler: Delphi 7-era or Delphi 2006/2007 (Borland/CodeGear). FastMM4 Borland Edition (2004–2005) memory manager.
  • GUI framework: VCL — TForm, TButton, TEdit, TRadioButton, TGroupBox, TLabeledEdit, TUpDown, TStaticText, TTrayIcon, TPopupMenu.
  • HTTP client: WinInet / UrlMon (Delphi wrapper units, not direct API imports).
  • Hashing: Custom md5hash unit for MD5 transforms.
  • Compression: ZLibConst unit for zlib decompression (likely for wordlist or response handling).
  • Custom units: evalcomp (expression compiler / evaluator), QuickPixel, VolumeControl, XPMenu.

Capabilities

  • dictionary-attack-password-brute-force — Loads a .txt wordlist and tests passwords against a target login.
  • list-attack-credential-stuffing — Loads a login:password combo list and tests pairs.
  • multi-threaded-http-authentication — Configurable thread count via TUpDown, parallel HTTP POST requests via WinInet.
  • system-tray-minimization — TTrayIcon + TPopupMenu allows hiding the window while threads run.
  • md5-password-transform — Custom MD5 unit present for hashing passwords or verifying responses.
  • social-engineering-double-extension-distribution — Observed distributed as SALES_INQUIRY.pdf.exe.

Deploy / TTPs

Observed Distribution

  • SALES_INQUIRY.pdf.exe — double-extension masquerade exploiting Windows' hidden-extension default (T1036.007).
  • No persistence, no C2, no host-data theft. The tool is standalone and the "malicious" behavior is the credential-stuffing against third-party services.

UI Controls (from DFM resource)

Control Purpose
txtDict / txtList Password dictionary or combo list file path
btnDictOpen / btnListOpen File-open dialog (.txt filter)
rdoDict / rdoList Attack mode: dictionary vs list
txtLogin Target login/username
txtThreads / udThreads Thread count spinner
btnStart / btnStop Start / stop attack
cntGood / cntBad / cntCheck Valid / invalid / total counters (green/maroon/navy)
TrayIcon / PopupMenu System tray hide/start/stop/exit

Notable Analyses

  • b04aa5d0 — First observed sample. SALES_INQUIRY.pdf.exe, Delphi VCL, Russian UI, ICQ:322322032. Static-only (no CAPE Windows guest). ^[/intel/analyses/b04aa5d0ede5653b20f6db6d6df0020e396dfe8688f2c4712cff6dccce2002d4.html]

Variants / Aliases

  • No other confirmed siblings in this corpus. The tool may circulate under different filenames on Russian-language cracking forums.

Related