MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8080b4f7a238f28435649f74fdd5679f7f7133ea81d12d9f10b05017b0897b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BruteRatel


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8080b4f7a238f28435649f74fdd5679f7f7133ea81d12d9f10b05017b0897b1
SHA3-384 hash: 7e6bd782befd81e1757a599caea33fcd8f25dcb19d01716f8e6d1f0469b1d696d01f49d9ec44725ca78ac68de3059121
SHA1 hash: 4504fd0afe692d405af8dba26a66a907a71b56fc
MD5 hash: 43453a594c177b330476da9cee742d28
humanhash: jig-black-georgia-papa
File name:badger_x64_stealth_rtl.dll
Download: download sample
Signature BruteRatel
Create hunting rule
File size:247'872 bytes
First seen:2025-03-13 14:02:17 UTC
Last seen:2025-03-13 14:31:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 00eb539293304c62a55a0a3a9463ce6b (2 x BruteRatel)
ssdeep 3072:/x8adlIkXDBumBr1F8WLBXIZ4mvrr4tUJR699vxcv7I4:J8a7I6Bu/6mjro9cv7B
TLSH T1F8347212F36368EDD97AC1B047AFA233BB31B84D55747E2E5720CB552F10E21A66DB08
TrID 38.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter cedricgmirror2
Tags:BazaarLoader BruteRatel exe


Avatar
cedricgmirror2
Mapped in memory, first bytes of the PE header were wiped an manually reconstructed

Intelligence

File Origin
# of uploads :
2
# of downloads :
535
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
badger_x64_stealth_rtl.dll
Verdict:
No threats detected
Analysis date:
2025-03-13 14:03:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/cfccc99c-50f5-44fd-b740-42b4fb561036

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d2eef33962f1a6f470d624
Tags:
injection virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
masquerade overlay
Link:
https://www.filescan.io/uploads/67d2e5a13c5f644bd951deb8/reports/14bee152-75c1-469f-8043-5548cde09faf/overview
Verdict:
Malicious
Labled as:
Brutel.Marte.K.Generic
Link:
https://www.hybrid-analysis.com/sample/d8080b4f7a238f28435649f74fdd5679f7f7133ea81d12d9f10b05017b0897b1
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/709ed6a4-3633-4bae-b143-658cb14b7f59
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1637363
Signature
Antivirus / Scanner detection for submitted sample
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Sets debug register (to hijack the execution of another thread)
Behaviour
Behavior Graph:
Download SVG
Score:
69%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/d8080b4f7a238f28435649f74fdd5679f7f7133ea81d12d9f10b05017b0897b1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8080b4f7a238f28435649f74fdd5679f7f7133ea81d12d9f10b05017b0897b1/
Threat name:
Win64.Trojan.BrutelMarte
Create hunting rule
Status:
Malicious
First seen:
2025-03-13 14:03:10 UTC
File Type:
PE+ (Dll)
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3aeawt32eohsqq2wjh3u7xkwph37oez6vaorfwprbmcqc6yis6yq._file
Verdict:
malicious
Label(s):
bruteratelc4
Create hunting rule
Similar samples:
error
BruteRatel
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250313-rcq49axjz3/
Verdict:
Malicious
Tags:
red_team_tool brute_ratel
YARA:
HKTL_EXE_Brute_Ratel_July_09
Link:
https://app.threat.zone/submission/8c158c19-8e57-4a98-964a-1f4f62ad9af6
Unpacked files
SH256 hash:
d8080b4f7a238f28435649f74fdd5679f7f7133ea81d12d9f10b05017b0897b1
MD5 hash:
43453a594c177b330476da9cee742d28
SHA1 hash:
4504fd0afe692d405af8dba26a66a907a71b56fc
Link:
https://www.unpac.me/results/9d92a8ea-5a3c-4d3f-86b3-f372c5005dd3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d8080b4f7a238f28435649f74fdd5679f7f7133ea81d12d9f10b05017b0897b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BruteRatel
Create hunting rule
Author:kevoreilly
Description:BruteRatel Payload
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_BruteRatel_5b12cbab
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BazaLoader

Executable exe 5C7A3BD2BAA8303354D8098B8D5961F111E467002BB0C6FEE120825B32798228

BruteRatel

Executable exe 4749186ec02e1600ae8b8031478d7ce7074e96cf70de008ef0037f2d63e93647

BruteRatel

Executable exe ba847f3edf4f9c540641c30f45e40baee8287d30d5aef59543d24f0375140f27

BruteRatel

Executable exe d8080b4f7a238f28435649f74fdd5679f7f7133ea81d12d9f10b05017b0897b1

(this sample)

  
Dropped by
SHA256 ba847f3edf4f9c540641c30f45e40baee8287d30d5aef59543d24f0375140f27
  
Dropped by
MD5 decf7b259d75e0e499f44c5a915b3175

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::FreeConsole

Comments