bruteratel | 5c054436b3a1abe33e653fca3b439af21b2eed22c868b168af26ae413ebbb043 | Triage

Sharing

General

Target

9bb4d87782053905b661324b1daa3fa4fe5fdfdd9bf46312c1316a87dfe65e0eN.exe
Size

395KB
Sample

241111-x6nh4sxpcp
MD5

7c6efc9cb77af66e8bcfc82b6513d5a5
SHA1

6fcda26bf700c93430330b9c55a87eb8b7ebad67
SHA256

5c054436b3a1abe33e653fca3b439af21b2eed22c868b168af26ae413ebbb043
SHA512

9a61ad8a16b42472d89cceb24288e6c9d669c47c775fd0603b97a79c9ee82990a7d814391f10e779e5b406876e2d421e053052fa6a4e7c814244553b2eb80579
SSDEEP

6144:srDkIs4y70u4HXs4yr0u490u4Ds4yvW8lc:4c4O0dHc4i0d90dA4r

Score

10^/10

bruteratel backdoor discovery persistence

Malware Config

Targets

- Target
  
  9bb4d87782053905b661324b1daa3fa4fe5fdfdd9bf46312c1316a87dfe65e0eN.exe
- Size
  
  395KB
- MD5
  
  7c6efc9cb77af66e8bcfc82b6513d5a5
- SHA1
  
  6fcda26bf700c93430330b9c55a87eb8b7ebad67
- SHA256
  
  5c054436b3a1abe33e653fca3b439af21b2eed22c868b168af26ae413ebbb043
- SHA512
  
  9a61ad8a16b42472d89cceb24288e6c9d669c47c775fd0603b97a79c9ee82990a7d814391f10e779e5b406876e2d421e053052fa6a4e7c814244553b2eb80579
- SSDEEP
  
  6144:srDkIs4y70u4HXs4yr0u490u4Ds4yvW8lc:4c4O0dHc4i0d90dA4r
Score

10^/10

discovery persistence bruteratel backdoor
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- Brute Ratel C4
  A customized command and control framework for red teaming and adversary simulation.
  backdoor bruteratel
- Bruteratel family
  bruteratel
- Detect BruteRatel badger
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

bruteratelbackdoordiscoverypersistence