Brute Ratel C4
Brute Ratel is a pentesting tool and post-exploitation framework. It allows for the deployment of badger malware on remote hosts that connect to the attacker's command and control server to receive commands or transmit the results of already executed commands to operators.The tool is designed to evade detection by EDR and antivirus solutions; almost all security products do not detect malware in it.
Peculiarities:
- Opening accounts. For this, you can use LDAP queries, the commands "net group 'Domain Admins' /domain" and "net user /domain".
- Use of web protocols. HTTPS and DNS over HTTPS can be used for C2 communication.
- Using the Windows command line shell. You can use cmd.exe to run commands.
- Camouflage. For example, Brute Ratel C4 can use Microsoft Word icons to hide malicious LNK files.
- Calling and dynamically resolving hashed APIs.
- Creating Windows system services. They can be created to execute commands.
- Launching via opening malicious documents. Brute Ratel C4 can launch when the user opens malicious documents.
Call NtDelayExecution to pause execution.
VIP Forum — Lifetime Access🔥
Join Our VIP Group Get lifetime access for just $100 and unlock a growing collection of 50+ PC and Android RATs, along with regular updates and community support.
What You'll Get
💻 50+ PC & Android RATs 🔄 Regular updates & new releases🛠 Community support 📢 Latest announcements and updates ♾️ Lifetime VIP access 👥 Private members-only forum💎 Lifetime VIP — $100 One Time payment, Lifetime access.
👉 Join now and become a VIP member (https://payment.ratlab.forum/)