Brute Ratel C4 (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.brute_ratel_c4 (Back to overview)

Brute Ratel C4

aka: BOLDBADGER, BruteRatel

VTCollection

Brute Ratel C4 (BRC4) is a commercial framework for red-teaming and adversarial attack simulation, which made its first appearance in December 2020. It was specifically designed to evade detection by endpoint detection and response (EDR) and antivirus (AV) capabilities. BRC4 allows operators to deploy a backdoor agent known as Badger (aka BOLDBADGER) within a target environment.
This agent enables arbitrary command execution, facilitating lateral movement, privilege escalation, and the establishment of additional persistence avenues. The Badger backdoor agent can communicate with a remote server via DNS over HTTPS, HTTP, HTTPS, SMB, and TCP, using custom encrypted channels. It supports a variety of backdoor commands including shell command execution, file transfers, file execution, and credential harvesting. Additionally, the Badger agent can perform tasks such as port scanning, screenshot capturing, and keystroke logging. Notably, in September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.

References

2026-01-09 ⋅ JSAC 2026 ⋅ Joseph Chen
The Return of Old Forces: Revealing New Campaigns Connected to A Missing Cyber Mercenary Firm
Linodas Brute Ratel C4 Cobalt Strike DinodasRAT HyperBro JuicyPotato MimiKatz Reshell VShell

2025-09-29 ⋅ The DFIR Report ⋅ The DFIR Report
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion
Brute Ratel C4 Cobalt Strike Latrodectus

2025-06-24 ⋅ Bridewell ⋅ Bridewell
2025 Cyber Threat Intelligence Report
AsyncRAT Brute Ratel C4 Cobalt Strike Fog Ghost RAT Lumma Stealer Meduza Stealer Quasar RAT RedLine Stealer Sliver

2025-04-03 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Threat actors leverage tax season to deploy tax-themed phishing campaigns
Brute Ratel C4 CloudEyE Latrodectus Remcos Storm-0249

2025-01-10 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update July to December 2024
Coper FluBot Hook Mirai FAKEUPDATES AsyncRAT BianLian Brute Ratel C4 Cobalt Strike DanaBot DCRat Havoc Latrodectus NjRAT Quasar RAT RedLine Stealer Remcos Rhadamanthys Sliver Stealc

2024-11-18 ⋅ Proofpoint ⋅ Proofpoint Threat Research Team, Selena Larson, Tommy Madjar
Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape
AsyncRAT Brute Ratel C4 DanaBot DarkGate Latrodectus Lumma Stealer NetSupportManager RAT XWorm

2024-10-30 ⋅ EclecticIQ ⋅ EclecticIQ Threat Research Team
Inside Intelligence Center: LUNAR SPIDER Enabling Ransomware Attacks on Financial Sector with Brute Ratel C4 and Latrodectus
BlackCat Brute Ratel C4 Latrodectus

2024-10-22 ⋅ Airbus ⋅ Adams Kone
Incident Response: Analysis of recent version of BRC4
Brute Ratel C4

2024-08-01 ⋅ Krakz ⋅ Pierre Le Bourhis
Latrodectus dropped by BR4
Brute Ratel C4 Latrodectus

2024-06-24 ⋅ RevEng.AI ⋅ RevEng.AI
Latrodectus Affiliate Resumes Operations Using Brute Ratel C4 Post Operation Endgame
Brute Ratel C4 Latrodectus

2023-09-27 ⋅ Cyber Geeks ⋅ Vlad Pasca
A Deep Dive into Brute Ratel C4 payloads – Part 2
Brute Ratel C4

2023-09-22 ⋅ Mandiant ⋅ Dan Black, Josh Atkins, Luke Jenkins
Backchannel Diplomacy: APT29’s Rapidly Evolving Diplomatic Phishing Operations
Brute Ratel C4 Cobalt Strike EnvyScout GraphDrop QUARTERRIG sRDI Unidentified 107 (APT29)

2023-08-31 ⋅ Cyber Geeks ⋅ CyberMasterV
A Deep Dive into Brute Ratel C4 Payloads
Brute Ratel C4

2023-08-07 ⋅ Recorded Future ⋅ Insikt Group
RedHotel: A Prolific, Chinese State-Sponsored Group Operating at a Global Scale
Winnti Brute Ratel C4 Cobalt Strike FunnySwitch PlugX ShadowPad Spyder Earth Lusca

2023-04-28 ⋅ Twitter (@MichalKoczwara) ⋅ Michael Koczwara
Tweet on hunting BRC4 infrastructure
Brute Ratel C4

2023-03-06 ⋅ ProtectedMo.de ⋅ Boymoder RE
Brute Ratel - Scandinavian Defence
Brute Ratel C4

2023-02-23 ⋅ Andrea Fortuna's Blog ⋅ Andrea Fortuna
How to detect Brute Ratel activities
Brute Ratel C4

2023-02-15 ⋅ Yoroi ⋅ Carmelo Ragusa, Luigi Martire
Hunting Cyber Evil Ratels: From the targeted attacks to the widespread usage of Brute Ratel
Brute Ratel C4

2023-01-29 ⋅ Dark Vortex ⋅ Paranoid Ninja
Hiding In PlainSight - Indirect Syscall is Dead! Long Live Custom Call Stacks
Brute Ratel C4

2023-01-26 ⋅ Dark Vortex ⋅ Paranoid Ninja
Hiding In PlainSight - Proxying DLL Loads To Hide From ETWTI Stack Tracing
Brute Ratel C4

2022-10-25 ⋅ Medium walmartglobaltech ⋅ Jason Reaves
Brute Ratel Config Decoding update
Brute Ratel C4

2022-10-12 ⋅ Trend Micro ⋅ Ian Kenefick, Lucas Silva, Nicole Hernandez
Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike
Black Basta Brute Ratel C4 Cobalt Strike QakBot

2022-10-12 ⋅ Twitter (@embee_research) ⋅ Embee_research, Huntress Labs
Tweets on detection of Brute Ratel via API Hashes
Brute Ratel C4

2022-10-04 ⋅ splunk ⋅ Splunk Threat Research Team
Deliver a Strike by Reversing a Badger: Brute Ratel Detection and Analysis
Brute Ratel C4

2022-09-01 ⋅ Medium michaelkoczwara ⋅ Michael Koczwara
Hunting C2/Adversaries Infrastructure with Shodan and Censys
Brute Ratel C4 Cobalt Strike Deimos GRUNT IcedID Merlin Meterpreter Nighthawk PoshC2 Sliver

2022-08-22 ⋅ Microsoft ⋅ Microsoft
Extortion Economics - Ransomware’s new business model
BlackCat Conti Hive REvil AgendaCrypt Black Basta BlackCat Brute Ratel C4 Cobalt Strike Conti Hive Mount Locker Nokoyawa Ransomware REvil Ryuk

2022-08-03 ⋅ MDSec ⋅ Dominic Chell
PART 3: How I Met Your Beacon – Brute Ratel
Brute Ratel C4

2022-07-09 ⋅ spookysec ⋅ Ronnie
Analyzing a Brute Ratel Badger
Brute Ratel C4

2022-07-07 ⋅ SOCRadar ⋅ SOCRadar
Brute Ratel Utilized By Threat Actors In New Ransomware Operations
Brute Ratel C4

2022-07-06 ⋅ YouTube (IppSec) ⋅ IppSec
Reversing Malware How is APT 29 Successful w/ this Phishing Tech and BRc4 (Brute Ratel) opsec fails?
Brute Ratel C4

2022-07-05 ⋅ Mike Harbison
When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors
Brute Ratel C4

2021-06-01 ⋅ Dark Vortex ⋅ Dark Vortex
PE Reflection: The King is Dead, Long Live the King
Brute Ratel C4

Yara Rules

[TLP:WHITE] win_brute_ratel_c4_auto (20260917 | Detects win.brute_ratel_c4.)

rule win_brute_ratel_c4_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.brute_ratel_c4."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 89542410 48894c2408 4883ec48 8b442458 89442424 48c744242800000000 41b800060400 }
            // n = 7, score = 100
            //   89542410             | arpl                word ptr [esp + 0x30], ax
            //   48894c2408           | dec                 eax
            //   4883ec48             | imul                eax, eax, 0x10
            //   8b442458             | dec                 eax
            //   89442424             | lea                 ecx, [0x42ee3]
            //   48c744242800000000     | dec    eax
            //   41b800060400         | add                 ecx, eax

        $sequence_1 = { eb08 b9e8030000 41ffd4 4889e8 f0480fb13b 4889c6 4885c0 }
            // n = 7, score = 100
            //   eb08                 | mov                 esi, ecx
            //   b9e8030000           | mov                 dword ptr [ebp], edx
            //   41ffd4               | jmp                 0xa
            //   4889e8               | mov                 ecx, 0x3e8
            //   f0480fb13b           | inc                 ecx
            //   4889c6               | call                esp
            //   4885c0               | dec                 eax

        $sequence_2 = { 53 4883ec20 488b2d???????? 4889ce 895500 }
            // n = 5, score = 100
            //   53                   | push                ebx
            //   4883ec20             | dec                 eax
            //   488b2d????????       |                     
            //   4889ce               | sub                 esp, 0x20
            //   895500               | dec                 eax

        $sequence_3 = { 4889f9 ffd0 8305????????01 ba01000000 e9???????? 488d0db92e0400 }
            // n = 6, score = 100
            //   4889f9               | dec                 ecx
            //   ffd0                 | add                 ebp, 4
            //   8305????????01       |                     
            //   ba01000000           | dec                 ebp
            //   e9????????           |                     
            //   488d0db92e0400       | nop                 

        $sequence_4 = { 89442424 48c744242800000000 41b800060400 488d15d02f0000 488d4c2420 e8???????? 4889442428 }
            // n = 7, score = 100
            //   89442424             | dec                 esp
            //   48c744242800000000     | mov    edi, dword ptr [eax + 0x68]
            //   41b800060400         | inc                 ecx
            //   488d15d02f0000       | cmp                 dword ptr [edi + 0xc], 0
            //   488d4c2420           | je                  0x1f
            //   e8????????           |                     
            //   4889442428           | dec                 esp

        $sequence_5 = { 4c8d2c06 4983c504 ffcd 90 85ed 78bc 89ef }
            // n = 7, score = 100
            //   4c8d2c06             | mov                 eax, ebp
            //   4983c504             | dec                 eax
            //   ffcd                 | mov                 esi, eax
            //   90                   | dec                 eax
            //   85ed                 | test                eax, eax
            //   78bc                 | dec                 esp
            //   89ef                 | lea                 ebp, [esi + eax]

        $sequence_6 = { 4c01f9 49d1e8 488b542430 41ffd4 85c0 75c9 }
            // n = 6, score = 100
            //   4c01f9               | mov                 edx, 1
            //   49d1e8               | dec                 eax
            //   488b542430           | lea                 ecx, [0x42eb9]
            //   41ffd4               | test                eax, eax
            //   85c0                 | jne                 0xffffffcd
            //   75c9                 | inc                 ecx

        $sequence_7 = { 4989f8 ba01000000 4889f1 e8???????? 4189c4 }
            // n = 5, score = 100
            //   4989f8               | dec                 eax
            //   ba01000000           | mov                 edx, dword ptr [esp + 0x30]
            //   4889f1               | inc                 ecx
            //   e8????????           |                     
            //   4189c4               | call                esp

        $sequence_8 = { 8b460c 4939c4 0f837d000000 4b8d3c64 }
            // n = 4, score = 100
            //   8b460c               | mov                 eax, dword ptr [edi + esi*4 + 0x10]
            //   4939c4               | inc                 ecx
            //   0f837d000000         | mov                 esi, dword ptr [edi + eax]
            //   4b8d3c64             | dec                 ecx

        $sequence_9 = { 486bc010 488d0de32e0400 4803c8 488bc1 48634c2434 }
            // n = 5, score = 100
            //   486bc010             | jae                 0x83
            //   488d0de32e0400       | dec                 ebx
            //   4803c8               | lea                 edi, [esp]
            //   488bc1               | dec                 esp
            //   48634c2434           | add                 esi, ebp

        $sequence_10 = { c744242c00000000 8b44242c 89442438 4863442430 486bc010 488d0de32e0400 }
            // n = 6, score = 100
            //   c744242c00000000     | mov                 dword ptr [esp + 0x28], eax
            //   8b44242c             | dec                 eax
            //   89442438             | imul                eax, eax, 0x10
            //   4863442430           | dec                 eax
            //   486bc010             | lea                 ecx, [0x42ee3]
            //   488d0de32e0400       | dec                 eax

        $sequence_11 = { 85c0 75c9 418b44b710 418b3407 498d2c07 4883c504 }
            // n = 6, score = 100
            //   85c0                 | test                ebp, ebp
            //   75c9                 | js                  0xffffffc3
            //   418b44b710           | mov                 edi, ebp
            //   418b3407             | dec                 eax
            //   498d2c07             | mov                 ecx, edi
            //   4883c504             | call                eax

    condition:
        7 of them and filesize < 607232
}

[TLP:WHITE] win_brute_ratel_c4_w0 (20221012 | No description)

rule win_brute_ratel_c4_w0 {
	//Looks for API hashes present in Brute Ratel Badger Payloads. 
	meta:
		author = "Embee_Research @ Huntress"
		vendor = "Huntress"
		created = "2022/10/12"
		source = "https://raw.githubusercontent.com/embee-research/Yara/main/BruteSyscalls.yara"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4"
        malpedia_rule_date = "20221012"
        malpedia_hash = ""
        malpedia_version = "20221012"
        malpedia_sharing = "TLP:WHITE"
	strings:
		
		$hash1 = {89 4d 39 8c} //NtProtectVirtualMemory
		$hash2 = {bd ca 3b d3} //NtAllocateVirtualMemory
		$hash3 = {b2 c1 06 ae} //NtWaitForSingleObject
		$hash4 = {74 eb 1d 4d} //NtCreateThreadEx
	
	condition:
		//0x5a4d == regular pe/dll
		//0x00e8 == start of Brute shellcode 
		(2 of them) and (uint16(0) == 0x5a4d or uint16(0) == 0x00e8)
}

Download all Yara Rules

Brute Ratel C4 Propose Change

References

Yara Rules

Brute Ratel C4