Brute Ratel C4Malware
- boldbadger
- BruteRatel
Brute Ratel C4 (BRC4) is a commercial framework for red-teaming and adversarial attack simulation, which made its first appearance in December 2020. It was specifically designed to evade detection by endpoint detection and response (EDR) and antivirus (AV) capabilities. BRC4 allows operators to deploy a backdoor agent known as Badger (aka BOLDBADGER) within a target environment.From MISP Galaxy
Last reported 8 months ago, by Group-IB3 reports
ATT&CK techniques
6 of 47 · each with the sentence it comes from- T1036Masquerading
“For example, WerFault.exe and wermgr.exe are among the most attractive targets for masquerading:”
- T1003.001LSASS Memory
“LSASS Memory - T1003.001”
- T1018Remote System Discovery
“Remote System Discovery - T1018”
- T1021.001Remote Desktop Protocol
“Remote Desktop Protocol - T1021.001”
- T1021.002SMB/Windows Admin Shares
“SMB/Windows Admin Shares - T1021.002”
- T1027.013Encrypted/Encoded File
“Encrypted/Encoded File - T1027.013”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Shaping Shadows: Breaking Down New ShadowSyndicate Methods and Infrastructure“Brute Ratel C4 is a commercial red-teaming framework with advanced evasion techniques.”
-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“Multiple types of malware were deployed across the intrusion, including Latrodectus, Brute Ratel C4, Cobalt Strike, BackConnect, and a custom .NET backdoor.”
-
Upping the Ante: Detecting In-Memory Threats with Kernel Call Stacks“See below for a screenshot detecting Nighthawk, BruteRatel, CobaltStrike, and ATP41’s StealthVector.”
Indicators in its reports
named in the reports above- hxxp://91.194.11[.]64/MSI.msiin 1 report
- 91.194.11[.]64in 1 report
- disk1[.]cabin 1 report
- 193.168.143[.]196in 1 report
- hxxps://cloudmeri[.]com/comm.phpin 1 report
- cloudmeri[.]comin 1 report
- hxxp://45.129.199[.]214/vodeo/wg01ck01in 1 report
- 45.129.199[.]214in 1 report
- 94.232.40[.]49in 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.