RATel

RATel 바이러스토탈에 업로드하지 마세요! RATel이 안티바이러스에 탐지되는 것을 방지하려면 페이로드를 TOTAL VIRUS에 업로드하지 마십시오. 매달 제가 직접 페이로드가 안티바이러스에 탐지되는지 테스트할 것입니다. 따라서 매달 RATel의 은밀성을 입증할 수 있는 사진을 보여드리겠습니다. 설명 RAT-el은 Windows 머신을 제어할 수 있는 오픈 소스 침투 테스트 도구입니다. 클라이언트-서버 모델로 작동하며, 서버는 명령을 보내고 클라이언트는 명령을 실행한 후 결과를 서버에 다시 보냅니다. 클라이언트는 안티바이러스...

nanorobeus

Nanorobeus Kerberosチケットを管理するためのCOFFファイル（BOF）。 対応エージェント Sliver Brute Ratel Cobalt Strike コマンド luid - 現在のログオンIDを取得 sessions /luid: | /all - ログオンセッションを取得 klist /luid: | /all - Kerberosチケットを一覧表示 dump /luid: | /all - Kerberosチケットをダンプ ptt /ticket: /luid: - Kerberosチケットをログオンセッションにインポート purge /luid:...

Brute-Ratel-C4-Community-Kit

Brute-Ratel-C4 このリポジトリには、Brute Ratel C4 https://bruteratel.com/ 用のスクリプト、設定、および非推奨のペイロードローダーが含まれています。deprecated フォルダーに追加されたものは、BRc4 の最新リリースには含まれません。...

BruteRatel-DetectionTools

BruteRatel-DetectionTools Brute Ratel C4 バッジャーをデコードするためのツールとルールのコレクション すべてのツールとルールは、PaloAlto のレポート https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ で特定されたサンプルに基づいています。 Yara ルール この Yara ルールは、Unit42 レポートに含まれるサンプルと、このルールによって識別された追加サンプルに対してテストされています。 root@kitploit: ❯ yara rule.yar BruteRatel...

badger-builder

badger-builder badger-builder 是一个用于生成动态 Brute Ratel C4 配置文件的 AI 辅助工具。只需为 badger-builder 提供一个你所需配置文件的 风格（flavor） ，它就会向 OpenAI 提示以获取合适的配置。 由 AI 生成的监听器/载荷配置文件： C2 URI 请求/响应 HTTP 头部 附加在 C2 请求/响应之前和之后的 HTTP 正文数据 服务器的 空响应 HTTP 正文 HTTP 正文数据可以以 XML、JSON 或 JavaScript 生成（并且请求格式可以与响应格式不同）。 我始终建议检查 OpenAI...

⚡ Weekly Recap: Critical SAP Exploit, AI-Powered Phishing, Major Breaches, New CVEs & More

What happens when cybercriminals no longer need deep skills to breach your defenses? Today's attackers are armed with powerful tools that do the heavy lifting — from AI-powered phishing kits to large botnets ready to strike. And they're not just after big corporations. Anyone can be a target when...

Malware Attackers Using MacroPack to Deliver Havoc, Brute Ratel, and PhantomCore

Threat actors are likely employing a tool designated for red teaming exercises to serve malware, according to new findings from Cisco Talos. The program in question is a payload generation framework called MacroPack, which is used to generate Office documents, Visual Basic scripts, Windows...

Threat actors using MacroPack to deploy Brute Ratel, Havoc and PhantomCore payloads

Cisco Talos recently discovered several related Microsoft Office documents uploaded to VirusTotal by various actors between May and July 2024 that were all generated by a version of a payload generator framework called "MacroPack." MacroPack is a framework designated for Red Team exercises, but w...

Malware Campaign Lures Users With Fake W2 Form

The following analysts contributed to the research: Evan McCann, Matt Smith, Ipek Solak, Jake McMahon Rapid7 has recently observed an campaign targeting users searching for W2 forms using the Microsoft search engine Bing. Users are subsequently directed to a fake IRS website, enticing them to...

Telegram App Flaw Exploited to Spread Malware Hidden in Videos

A zero-day security flaw in Telegram's mobile app for Android called EvilVideo made it possible for attackers to share malicious files disguised as harmless-looking videos. The exploit appeared for sale for an unknown price in an underground forum on June 6, 2024, ESET said. Following responsible...

Patchwork Hackers Target Bhutan with Advanced Brute Ratel C4 Tool

The threat actor known as Patchwork has been linked to a cyber attack targeting entities with ties to Bhutan to deliver the Brute Ratel C4 framework and an updated version of a backdoor called PGoShell. The development marks the first time the adversary has been observed using the red teaming...

Researchers Discover New PlugX Malware Variant Spreading via Removable USB Devices

Cybersecurity researchers have uncovered a PlugX sample that employs sneaky methods to infect attached removable USB media devices in order to propagate the malware to additional systems. "This PlugX variant is wormable and infects USB devices in such a way that it conceals itself from the Window...

Quarterly Report: Incident Response Trends in Q3 2022

Ransomware and pre-ransomware engagements make up 40 percent of threats seen this quarter By Caitlin Huey. For the first time since compiling these reports, Cisco Talos Incident Response saw an equal number of ransomware and pre-ransomware engagements, making up nearly 40 percent of threats this...

Black Basta Ransomware Hackers Infiltrate Networks via Qakbot to Deploy Brute Ratel C4

The threat actors behind the Black Basta ransomware family have been observed using the Qakbot trojan to deploy the Brute Ratel C4 framework as a second-stage payload in recent attacks. The development marks the first time the nascent adversary simulation software is being delivered via a Qakbot...

Black Basta Ransomware Gang Infiltrates networks via QAKBOT, Brute Ratel, and Cobalt Strike

We analyzed a QAKBOT-related case leading to a Brute Ratel C4 and Cobalt Strike payload that can be attributed to the threat actors behind the Black Basta ransomware...

Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike

We analyzed a QAKBOT-related case leading to a Brute Ratel C4 and Cobalt Strike payload that can be attributed to the threat actors behind the Black Basta ransomware...

Hackers Abusing BRc4 Red Team Penetration Tool in Attacks to Evade Detection

Malicious actors have been observed abusing legitimate adversary simulation software in their attacks in an attempt to stay under the radar and evade detection. Palo Alto Networks Unit 42 said a malware sample uploaded to the VirusTotal database on May 19, 2022, contained a payload associated wit...

RAT-el - An Open Source Penetration Test Tool That Allows You To Take Control Of A Windows Machine

RAT-el is an open source penetration test tool that allows you to take control of a windows machine. It works on the client-server model, the server sends commands and the client executes the commands and sends the result back to the server. The client is completely undetectable by anti-virus...