Record · corpus.blog/posts/01a0de47-cd5d-7080-85f8-bde115c6f8f1

That’s No Honey Badger. It’s A Brute Ratel. A Look At BRC4.

thebinaryhick.blog · published 30 October 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at thebinaryhick.blog Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 75
Words captured: 5,919

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective Read at the source ↗

signal.org

https://www.sans.org/blog/cracked-brute-ratel-c4-framework-proliferates-across-the-cybercriminal-underground/

sans.org

https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/

mdsec.co.uk

When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors Read at the source ↗

unit42.paloaltonetworks.com

https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html

trendmicro.com

https://www.sans.org/cyber-security-courses/ransomware-incident-responders/

sans.org

https://github.com/SwiftOnSecurity/sysmon-config

github.com

https://ericzimmerman.github.io/

ericzimmerman.github.io

https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape

kroll.com

Update: BrowsingHistoryView v2.62 Read at the source ↗

nirsoft.net

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-2.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-2-1.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-3-1.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-4.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-6-1.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-6-2.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-8.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-9.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-11-1.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-12.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-13.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-14.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-16.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-18.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-19.png?ssl=1

i0.wp.com

https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

learn.microsoft.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/sysmon-proccreate-1.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-21.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-23.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-24.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-25.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-27.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-29.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-31.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-32.png?ssl=1

i0.wp.com

https://learn.microsoft.com/en-us/sysinternals/downloads/procmon

learn.microsoft.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-34.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-35.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-37.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-39.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-41.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-43.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-45-1.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-46-1.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-48.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-49.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-51.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-52.png?ssl=1

i0.wp.com

https://learn.microsoft.com/en-us/windows/win32/gdi/windows-gdi

learn.microsoft.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-54.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-56.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-57.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-58.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-59.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-60.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-62-1.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-63.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-64.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-65.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-66.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-67.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-68.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-69.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-70.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-71-2.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-72-1.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-73.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-74.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-76-1.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-78.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-79.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-80.png?ssl=1

i0.wp.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-82.png?ssl=1

i0.wp.com

https://devblogs.microsoft.com/powershell/powershell-the-blue-team/

devblogs.microsoft.com

https://i0.wp.com/thebinaryhick.blog/wp-content/uploads/2022/10/figure-84.png?ssl=1

i0.wp.com