Palo Alto Brute Ratel July 2022

Brute Ratel C4 has the ability to upload files from a compromised system.

Brute Ratel C4 has the ability to use RPC for lateral movement.

Brute Ratel C4 has the ability to use SMB to pivot in compromised networks.

Brute Ratel C4 can use WinRM for pivoting.

Brute Ratel C4 has used encrypted payload files and maintains an encrypted configuration structure in memory.

Brute Ratel C4 can call and dynamically resolve hashed APIs.

Brute Ratel C4 has used a payload file named OneDrive.update to appear benign.

Brute Ratel C4 has used Microsoft Word icons to hide malicious LNK files.

Brute Ratel C4 can conduct port scanning against targeted systems.

Brute Ratel C4 can use WMI to move laterally.

Brute Ratel C4 can enumerate all processes and locate specific process IDs (PIDs).

Brute Ratel C4 can use cmd.exe for execution.

Brute Ratel C4 can use HTTPS and HTTPS for C2 communication.

Brute Ratel C4 can use DNS over HTTPS for C2.

Brute Ratel C4 can use LDAP queries, `net group "Domain Admins" /domain` and `net user /domain` for discovery.

Brute Ratel C4 has the ability to use TCP for external C2.

Brute Ratel C4 can use legitimate websites for external C2 channels including Slack, Discord, and MS Teams.

Brute Ratel C4 can download files to compromised hosts.

Brute Ratel C4 can call multiple Windows APIs for execution, to share memory, and defense evasion.

Brute Ratel C4 can take screenshots on compromised hosts.

Brute Ratel C4 has the ability to deobfuscate its payload prior to execution.

Brute Ratel C4 has gained execution through users opening malicious documents.

Brute Ratel C4 can use LDAP queries and `nltest /domain_trusts` for domain trust discovery.

Brute Ratel C4 can call `NtDelayExecution` to pause execution.

Brute Ratel C4 can detect EDR userland hooks.

Brute Ratel C4 can decode Kerberos 5 tickets and convert it to hashcat format for subsequent cracking.

Brute Ratel C4 can create Windows system services for execution.

Brute Ratel C4 can use DNS over HTTPS for C2.

Brute Ratel C4 has used search order hijacking to load a malicious payload DLL as a dependency to a benign application packaged in the same ISO. Brute Ratel C4 has loaded a malicious DLL by spoofing the name of the legitimate Version.DLL and placing it in the same folder as the digitally-signed Microsoft binary OneDriveUpdater.exe.

Brute Ratel C4 has the ability to hide memory artifacts and to patch Event Tracing for Windows (ETW) and the Anti Malware Scan Interface (AMSI).