BRUTERATEL BASIC OPEN FRAMEWORK

Context

Initial BruteRatel Sample SHA256 : d8080b4f7a238f28435649f74fdd5679f7f7133ea81d12d9f10b05017b0897b1

Initial Sample Source :
bazaar.abuse.ch

VirusTotal :
VirusTotal


Conveniently sold as a ‘red teaming tool’ with advanced capabilities to avoid detection from EDR and antivirus, BruteRatel is unsurprisingly used and abused by various cybercrime or state sponsored threat actors :

BruteRatel and CVE-2025-31324
BruteRatel and APT29

As a mean to raise awareness and help blue teams better understand the threat posed by this specific tool, I publish a stripped-down version from a sample found in the wild and uploaded on bazar.abuse.ch in late 2024

This version has been modified in the following fashion :

  • The First stage loader/obfuscator have been removed
  • The inner payload only connects to the following local IP : http://192.168.30.46/admin.php on port 80
  • SSL encryption has been removed

I also publish a basic php FrameWork to issue commands to this modified sample

This is a very basic php framework meant to test various commands from the malware and doesn’t offer any ‘C2’ features

A summary from most commands available from this sample is available here

I didn’t fully reverse / understood evry commands available nor do I intend to do so