Brute Ratel

Hunt queries (Shodan, Censys, Fofa, URLScan)

Hunt query sharings are temporarily disabled.

Summary

TL; DR: A commercial, post-compromise C2 framework.

Type: C2 framework

Targeted Operating Systems: Windows

Interesting characteristics: Evasion

Threat tag: win.brute_ratel_c4

Reporting: https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4

https://bruteratel.com/ 

TTPs: https://attack.mitre.org/software/S1063/ 

IOCs

• 37.119.57.195:9002
• 18.163.6.122:80
• 149.28.251.203:80
• 13.113.45.138:80
• 13.114.110.144:80
• 13.231.24.246:80
• 18.180.64.43:80
• 3.112.185.142:80
• 54.248.35.92:80
• 13.230.94.200:80
• 13.114.224.91:80
• 35.73.40.176:80
• 52.196.213.220:80
• 13.113.204.244:80
• 196.51.37.139:80
• 13.115.223.29:80
• 18.176.27.91:80
• 54.249.68.233:80
• 13.112.86.223:80
• 43.206.199.216:80
• 2600:9000:201a:6800:1e:5e67:e400:21:80
• 211.76.170.240:443
• 54.250.116.148:80
• 219.94.128.44:443
• 52.197.96.6:80
• 35.72.81.251:80
• 35.73.145.106:80
• 93.66.153.13:9002
• 13.113.86.16:80
• 13.113.189.83:80
• 3.36.144.103:443
• 3.115.218.3:80
• 3.112.78.101:80
• 54.150.47.200:80
• 54.150.226.102:80