bruteratel | 6e90804aa6d5fba2e5c4ba26676472e180fafa5c866a4e1b1190c2c2ac5212dc

Sharing

Copy URL Twitter E-mail

General

Target
AA3012606KW_1.2.840.113619.2.278.3.313303582.478.1784887739.736_vmmyvue02_bzgeD4GVXUCMV8xePKZgjg.zip
Size 347.1MB
Sample260826-3xpbyavze1
SHA256 6e90804aa6d5fba2e5c4ba26676472e180fafa5c866a4e1b1190c2c2ac5212dc
MD5 9759f5b490d218c7e1e4fc571487ec34
SHA1 301e3443bd783a3bc08589b7082e076827d0b2c8
SHA512 7ce71f01a9cfeee340d0384c4ef13a114544afdd1bdb6879aa767661a1f9b1717c87e1d06e6de5052c4bcb96a84915b7533addfe45381a880b0502945a657f9c
SSDEEP 6291456:HfpybroixBqqWulHPTH6xxKR3mJ2zPY7WTfRAU/O2os6Yt4W2PmIzQv/fXIm1BIt:/pyT3qqWu5TaxxKRUsP8Qr60NFIzQPIv
TLSH
T11709339DE2492029F67FC274796721116A1A2CED94C7D3AD98C6F2FC9EC21C13742D8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Launch Viewer.exe
- Size 96KB
- SHA256 2bb518ea24c7b48582bd5d8433b149493dc79232741569b06a74f36527c54c15
- MD5 f4aacea99fb8bb99f4fa85b8408e71f0
- SHA1 26944ec07cf9cf841b568045b07c7dbf63f15db4
- SHA512 b70648d20712cf6efc624d10a80cb18df329345c454ebbc5e1f7d6eed474a4c6a1c28212a0dafe0f15833f350d56044aa5430ff70323434c8271b45e4a0182c7
- SSDEEP 1536:Tvhu1sgLGZ8msPLoUpLgAiH+N/3N1ZK/md3t6Cplgn1CPP:T5/D8msPLoUpLgAiH+NbKmd3lW1kP
- TLSH
  T147A3FAA708AED6DED2E5143014ED51104958FC26399AC9BBF45C78840BFDE99B20EEFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery bruteratel spyware
- Detect BruteRatel badger
- Family: Brute Ratel C4
  A customized command and control framework for red teaming and adversary simulation.
  backdoor bruteratel
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  ddv/ACMD.dll
- Size 192KB
- SHA256 47a12c200f0d2b87fa3e21b93cdca9e667c6781a817f617f7d216de56b243a76
- MD5 f23396ffcd0f6851106d41535f5496f4
- SHA1 1da6c9954d3f69af1f71582fa964e74b6ffc2c47
- SHA512 8f5d5022126f2f99ee3fc89c938ad66c5b27c4e46a6095955cef78d8ac37675b85f80b119a559969427f685c4fb5e052a4e405ef308def35fbc6d758c77af876
- SSDEEP 3072:6UoYPJ6p7i3eSd/n46rpMJkIMxW5wC7yFeBYXXwyAE2u1D:66PNRJpMJkI4bCaeBYXXwyAXu
- TLSH
  T15E14291AB3A900EAD56BD33C89969352E6F770250F13D7CB13554B6E0E372D4AEBA700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3 behavioral4
- Target
  ddv/ACMDLib.dll
- Size 14KB
- SHA256 350755b5022aad497d21aeb2f0e50d5d3ab6f689a7ca27b89827bcf1a0e235b8
- MD5 1e61e087f3d50e98055512e17257c0a0
- SHA1 935bf58a3855187b6359d3bbe3ed5e678b95b1c5
- SHA512 e08e5b456db235597c8c6e478cbfdf89b7e384e0184f6343cb3cc91f496740bd6f0118004ddc5f6d0dda3f2388767cdfc21d5fcc47e5e48e4fd1997e054e53e7
- SSDEEP 384:w2QtUocmgr5QVL3/T5qAxcCs7zExBRs+h6:wXtpc75QVUAxTs7oxBRNs
- TLSH
  T1EE62C7D5F77AE52ACC5A8BB8609783106AB0E6081707CF17015DE99DDF052C8AEC1EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  ddv/ALGMPR.dll
- Size 1.1MB
- SHA256 efcfc59be1e7d1a1132f0054f31320a7041e6f2c5ab848be62d0d42a7faacb52
- MD5 cadd21795898ee163473b6e439400b0d
- SHA1 f827a6d65d83238ded1d124af9c5b5b650f79730
- SHA512 fb786ed49b603b24488963bccc323505f84c768c92d1299738d02aad0eca3885fce2fb71a1b19cfb64073c200b723dd4458a68a5415928d346ce825707be3994
- SSDEEP 24576:Kc3vbiGK6kVXnJhA0DpAgZg+jOwUPy6h:Kc2F6kVz9DpAYUPy6
- TLSH
  T16F353B1BB72A0285D429E279C856EF10F171744BD376CECB0B11666E2B737D0ECBA948
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  ddv/ALGPDM.dll
- Size 151KB
- SHA256 fbc19d71cbf2db849e1c33ea4484974198268bbcb1a0138f847a8614dd289f41
- MD5 208e422cf84dc83f1c1c2dc94c3c4d39
- SHA1 e495dfc4d8542054064e1ac9d2aeeded4b081699
- SHA512 893c021680bfcbb62ff56c31f0484ea0a83bb0f5959f37ef76c8f4e43c67d0f5f38e7cbd7008762c9a697b6ed323ce9be6fc24480ce6d1c1c79ae132d5b72652
- SSDEEP 3072:b4LzYz9FiHaFLBWeCClnM/GB1Hl6VRk6um:EC9FbBWiMW1Hl6VR
- TLSH
  T158E30856F3AB40A5E05BD27C89999346E6F6B0458B22F7DF1642032E0F333D07D3A699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  ddv/ALGSLC.dll
- Size 206KB
- SHA256 aba0a9e250541564508e3d1ea84c95e91fb38c78ac79df9ddadd9a33cb99f1f7
- MD5 95125860d736364a1ec245e32380c735
- SHA1 cec0d6f95fc789c27f91a99a8c70a2df11efdebc
- SHA512 7dc4fe5e3ff322261082beb1526cf6d63cd66ffa85ef257e0671839099b27dfe52dd1c61843d1a0933c2949075b6207ead6b0fb1c37c4d67e99e4773246bc561
- SSDEEP 3072:eoeueIoYQLc6x9HYFH7onidCYjKNgkCKWNLBTfQdnq7wEo8kMyN:ZTofL6FHEnGCbmKWNVV7wEo8
- TLSH
  T10D24172BB3771086D0A6E23898904115F2B6BB951722C7EF064B123D1F67FD87CBE568
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  ddv/clar.dll
- Size 48KB
- SHA256 7b8326963640f6edaedf40551dab7f3b4609c3ecccbaa6a3c2cf9ff852e45d1a
- MD5 b6c75357b475a7156513ae5c866c139e
- SHA1 0c5ffefb49e077692f44789fa0fc80bda1e846d5
- SHA512 d5c26e5d562d85646c43f3868817e219e5469180b60ee0d2b301c144b9ed9ae9f7be13c179a812e1b890295b76a71f21a13147bf6702ba7dcd1269a1267046bc
- SSDEEP 768:Zw0IFAmSo2/HdoTIp17GOfMlrdVPbPbeQ1bAyPyuzG:ZaFAbVdHpNdMlrdpPbeQ1syPyuq
- TLSH
  T16E233BAA335308A5E522D2BCC9AB1607D37774154B22AFEF43A1415A1F2B3C8B57BF10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  ddv/clftp.dll
- Size 39KB
- SHA256 dba5636e43ed0c5d740985ff41c643a517e98beec44d87584085930dae3125c8
- MD5 0486daa0eeaec4bdd774005642ead082
- SHA1 0309b0fad34f9659f09ff85a5add05cd2c3b2f64
- SHA512 21b16f23f48c3c638d42bd674f6160d058f06692435b73a9c1c71c86b8d55cc594fb9340d5ccfbc265b367a8e4b29792238d7f5f0aec0c3769c433de1da932aa
- SSDEEP 768:cgMrijBqQM6gVEJIhoc5bJayQOohiNe7a:1MIM6gIIB5bJs6e7a
- TLSH
  T151033A5A63A600E9E9A2D1F8C7676247E2F274114B226FDF0360821E1F336C5B57EF54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  ddv/com.dll
- Size 269KB
- SHA256 b6bbc4d3a2d8954932b95d78ced80d796b63e78da579a639083ac4829c5bbbf2
- MD5 119bd8832073f8df57b73403c4fbbda8
- SHA1 1c368e7b73d9213b01f3943f76ca0e12d2b78e40
- SHA512 e905e0c4037a7ae627e27d88fec3b92b383cac4873e5f581f07aa1ed6c9c2df00535c4995cc3dcb15dff36e8f40915df98fddde9664813058301912cce5e2f16
- SSDEEP 6144:h0nFUogWHUEvrAV24xFcdXYa0lMcSUpxtC:mFUogorAV9xOGa0VXbC
- TLSH
  T174444A0522AB4CC2DE265678CA079357E7F674C50706C9EB02B857892F3F6F0967F928
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  ddv/conf.dll
- Size 89KB
- SHA256 a0faffc6385b6937650aaceeecd7fbd5ff600398c9d65391458819e83e031d46
- MD5 d608e36307c36d19f6b8d94afe7f503c
- SHA1 84cad668fe0c8d84b6e700b22841078ec4ea46b3
- SHA512 aae0b2747bcb7acd1f26166e60a76c8582deb202a83855913a90048f940c6b18f02ec77a8ecbefb27f53b5b0420854b9633b6e6f6cbe0b26ad4328cdd5883182
- SSDEEP 1536:+epvXgY/sYXqf5SiQkJW4Hy5cHKLnmwsbbH24NN5JsR56a8PeH6y:B5X//Ni5gkJWMymKLXcbH2O5E8Peh
- TLSH
  T15193C4AE329244F8E8E9D978C7A32213D272740A1B815FEF121D86141F3FED5AD3AD54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  ddv/conn.dll
- Size 586KB
- SHA256 8452171a94bd2bc7de16d8455f168e9e777a991d23ab3ff45728fa1fd735d9c7
- MD5 e57ef76d5bc1469a7409907ff5340618
- SHA1 5940ef387a969eb573b36fe2c462ed3a8c157433
- SHA512 642a82a00899311c37a4bdffe9dbbd73f733fc01bb70208fb5f750ae9b2f4595ce70ec8ffc562d4c32ffe1eeecc786e5e660bdd984b99125e8a2f8a1235a81e0
- SSDEEP 6144:acdkO/B34k6YM2yAb89H+GhfmzbRMe5ynI0Cpxg3FmP+1P0M1t3Tv++c+qzkXrqN:pkO/B34ku/JPI0CpUjv++ca+g4f
- TLSH
  T102D42B6D53A009F6F82BC2788707911BFA7175028BE15DCB1A94C1926F53BC9B63FB84
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  ddv/cs-CZ/LNGM.resources.dll
- Size 439KB
- SHA256 22cd0b3360dc10140a922aae71bd3705927662d9088d40d535cb5d4c59f5b078
- MD5 a5ed259af485385156e3b8df9aa22b84
- SHA1 7839ef3236ab2a8f1e8d0b002415cb91e1c8de83
- SHA512 512525e3b304261073239a106524dc4939e8559a175a066996b9cf97aceaf5711e1a65399cc2776ee693fd6b2f05b043acc1e73e352fc07a0fcd2255458b64a9
- SSDEEP 12288:sRrZyDthh3cSKEjMpP/X+QeEjNC95SepDX7c5IxipCEy1:sarsci
- TLSH
  T194A40E113BFE146CF5F27B816FF9D558963EBAE91A82D11E0095198F06A1E028F72733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  ddv/da-DK/LNGM.resources.dll
- Size 516KB
- SHA256 b1e354523facac24ba09cba685604e401bf256a4463eb7655347c2b19215bb60
- MD5 da592fbda66437624445f637a2745db6
- SHA1 a94d3abc06806645f924eec5a53e0298a2189f66
- SHA512 ad63a48de227767d163c85837d019cde8b0a4302e59f7d6c7b856ca04ceec6e31be7631840e5309397154945c8ae92b1a8858a23c2c0dea12e660c66a6c507b5
- SSDEEP 12288:/RwHsXQpeyYI9gHXlbl6oQz/odEfrLpXDKLCpCbm:/iFpzKLCpCbm
- TLSH
  T17EB442413AFF206CF1F2BB956FB9D958D23EB9EA1A82C11E1094154F05A6F418B72733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  ddv/dcff.dll
- Size 136KB
- SHA256 232aba0c270b9b40a35f53cb9064ac664a133c5a986a8255e01df1733a52d21f
- MD5 c7926efc44a97a9e10f0e1ff1157a0ea
- SHA1 54abd4b2a5447079241a60e91f9b00efc1d68a39
- SHA512 16fa14c9a8f3ad22a351a9fdffe1198236561dcf7a800176699d34f5ec1f1ecec66c3eca94e0fdb29770f0e8668073fe6a4f111ffd60b5edbddb69b47b04ee4c
- SSDEEP 3072:RdtVe4RMVHNc6gzv1M47Jetz/Ksyz8KtCmTylfEkEA1:RdtVe4RkNc6gjt7Jq08d5Ek
- TLSH
  T11FD3072EB7C615A5DC52C1BACB125A13E17674104F11EFEF2398026A5F136E8FDBEA40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  ddv/ddp.dll
- Size 1.2MB
- SHA256 3ef2cbc72e3e2154900f8ce51efec97cf7fcf64fc33945ec74fe1562b17ed6f2
- MD5 470beeb84de63df98064e71d75be1851
- SHA1 9797affcb8938613bfc7fb6a75409da11fd47528
- SHA512 490a6677fa7958483eac6deb8d0dedaa75e63da986c8849ce222b33d05286bbb5ba4a7d861a19c6af5cfe28c5d325840e4825bdfc8e31c7bc6fc9e7d15127821
- SSDEEP 24576:P2vlfLNW/rniVrsmsUcGlkWkWZ9nM380Q4f2OviRTMT7OAglbpVjXfimJGK:P2vlfLVsmf1lkv09MM0Q4f2OviRTMT7q
- TLSH
  T135556C2B62AD00A5E4B9D1B9CA4F8607F2F2744607359ED703118A5E1B37EE97A7DF00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral29 behavioral30
- Target
  ddv/de-DE/LNGM.resources.dll
- Size 545KB
- SHA256 fbc9b1b23a5fae6dc5c9d8a089bb0e2cb18a886be8b5324e41559c439fa2b8c2
- MD5 c29974cc031c48210c8d765a9c116d29
- SHA1 e985891bce1290029a29535f736c9235399f9cf0
- SHA512 362fadce162757dc9c024675209651a844924c9065bbe600a93f4a5b5e64141911d0355344417cf51df0245c923696d8927dfc8b9c2ad4671ec5848fa427b921
- SSDEEP 12288:aRTJ/MDL/lwJBqJcDjJo2NbHEq414iUiv71w42jiceoDcS3M0mj+yybepXX:anwUiv7e42jiceoDcS3M0mj+yybepXX
- TLSH
  T113C465013AFF202DF1F37B916FB5DC58A63EBAEA1A42D11E0094654F06A5E518B72733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect BruteRatel badger

Family: Brute Ratel C4

Enumerates connected drives

Network Share Discovery

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32