Brute Ratel C4 (Malware Family)

Brute Ratel C4

There is no description at this point.

References

2023-03-06 ⋅ ProtectedMo.de ⋅ Boymoder RE
Brute Ratel - Scandinavian Defence
Brute Ratel C4

2023-02-15 ⋅ Yoroi ⋅ Luigi Martire, Carmelo Ragusa
Hunting Cyber Evil Ratels: From the targeted attacks to the widespread usage of Brute Ratel
Brute Ratel C4

2023-01-29 ⋅ Dark Vortex ⋅ Paranoid Ninja
Hiding In PlainSight - Indirect Syscall is Dead! Long Live Custom Call Stacks
Brute Ratel C4

2023-01-26 ⋅ Dark Vortex ⋅ Paranoid Ninja
Hiding In PlainSight - Proxying DLL Loads To Hide From ETWTI Stack Tracing
Brute Ratel C4

2022-10-25 ⋅ Medium walmartglobaltech ⋅ Jason Reaves
Brute Ratel Config Decoding update
Brute Ratel C4

2022-10-12 ⋅ Twitter (@embee_research) ⋅ Embee_research, Huntress Labs
Tweets on detection of Brute Ratel via API Hashes
Brute Ratel C4

2022-10-04 ⋅ splunk ⋅ Splunk Threat Research Team
Deliver a Strike by Reversing a Badger: Brute Ratel Detection and Analysis
Brute Ratel C4

2022-09-01 ⋅ Medium michaelkoczwara ⋅ Michael Koczwara
Hunting C2/Adversaries Infrastructure with Shodan and Censys
Brute Ratel C4 Cobalt Strike Deimos GRUNT IcedID Merlin Meterpreter Nighthawk PoshC2 Sliver

2022-08-22 ⋅ Microsoft ⋅ Microsoft
Extortion Economics - Ransomware’s new business model
BlackCat Conti Hive REvil AgendaCrypt Black Basta BlackCat Brute Ratel C4 Cobalt Strike Conti Hive Mount Locker Nokoyawa Ransomware REvil Ryuk

2022-08-03 ⋅ MDSec ⋅ Dominic Chell
PART 3: How I Met Your Beacon – Brute Ratel
Brute Ratel C4

2022-07-09 ⋅ spookysec ⋅ Ronnie
Analyzing a Brute Ratel Badger
Brute Ratel C4

2022-07-07 ⋅ SOCRadar ⋅ SOCRadar
Brute Ratel Utilized By Threat Actors In New Ransomware Operations
Brute Ratel C4

2022-07-06 ⋅ YouTube (IppSec) ⋅ IppSec
Reversing Malware How is APT 29 Successful w/ this Phishing Tech and BRc4 (Brute Ratel) opsec fails?
Brute Ratel C4

2022-07-05 ⋅ Mike Harbison
When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors
Brute Ratel C4

Yara Rules

[TLP:WHITE] win_brute_ratel_c4_w0 (20221012 | No description)

rule win_brute_ratel_c4_w0 {
	//Looks for API hashes present in Brute Ratel Badger Payloads. 
	meta:
		author = "Embee_Research @ Huntress"
		vendor = "Huntress"
		created = "2022/10/12"
		source = "https://raw.githubusercontent.com/embee-research/Yara/main/BruteSyscalls.yara"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4"
        malpedia_rule_date = "20221012"
        malpedia_hash = ""
        malpedia_version = "20221012"
        malpedia_sharing = "TLP:WHITE"
	strings:
		
		$hash1 = {89 4d 39 8c} //NtProtectVirtualMemory
		$hash2 = {bd ca 3b d3} //NtAllocateVirtualMemory
		$hash3 = {b2 c1 06 ae} //NtWaitForSingleObject
		$hash4 = {74 eb 1d 4d} //NtCreateThreadEx
	
	condition:
		//0x5a4d == regular pe/dll
		//0x00e8 == start of Brute shellcode 
		(2 of them) and (uint16(0) == 0x5a4d or uint16(0) == 0x00e8)
}

Download all Yara Rules

Brute Ratel C4 Propose Change

References

Yara Rules

Brute Ratel C4