Brute Ratel C4Tool
- BRC4
Brute Ratel C4 is a commercial red-teaming and adversarial attack simulation tool that first appeared in December 2020. Brute Ratel C4 was specifically designed to avoid detection by endpoint detection and response (EDR) and antivirus (AV) capabilities, and deploys agents called badgers to enable arbitrary command execution for lateral movement, privilege escalation, and persistence.From MITRE ATT&CK
Last reported 12 months ago, by The DFIR Report2 reports
ATT&CK techniques
6 of 49 · each with the sentence it comes from- T1003.001LSASS Memory
“LSASS Memory - T1003.001”
- T1018Remote System Discovery
“Remote System Discovery - T1018”
- T1021.001Remote Desktop Protocol
“Remote Desktop Protocol - T1021.001”
- T1021.002SMB/Windows Admin Shares
“SMB/Windows Admin Shares - T1021.002”
- T1027.013Encrypted/Encoded File
“Encrypted/Encoded File - T1027.013”
- T1027.016Junk Code Insertion
“Junk Code Insertion - T1027.016”
What the reports say
2 reports, newest first · the exact sentence from each-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“The encrypted intermediary BRC4 payload”
-
Know Thy Enemy: unraveling the “Hi-Tech Crime Trends 2022/2023” report“…learned that adversaries were looking for alternatives that weren’t as well-researched and were hard-to-detect, such as Brute RatelC4 (or BRc4).”
Indicators in its reports
named in the reports above- hxxp://91.194.11[.]64/MSI.msiin 1 report
- 91.194.11[.]64in 1 report
- disk1[.]cabin 1 report
- 193.168.143[.]196in 1 report
- hxxps://cloudmeri[.]com/comm.phpin 1 report
- cloudmeri[.]comin 1 report
- hxxp://45.129.199[.]214/vodeo/wg01ck01in 1 report
- 45.129.199[.]214in 1 report
- 94.232.40[.]49in 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.