Loading malware…
BraZetsu is a modular Python-based remote-access malware framework targeting Windows, compiled into native executables with Nuitka. It is attributed with high confidence to the Brazilian cybercriminal actor Exilware and supports initial-access-broker operations through the Infect Marketplace, also known as Infected Marketplace or Banco de Infects. The framework profiles compromised systems for resale and enables purchasers to execute additional tools and malware. BraZetsu and AgenteV2 have been assessed with high confidence to be the same framework. Five generations tracked between February and May 2026 show its evolution from a basic remote-access tool into an extensive reconnaissance and access-brokering platform.
BraZetsu enumerates system information, installed applications, processes, network services, recently accessed files, and active window titles. It identifies banking, ERP, e-commerce, industrial-control, backup, cloud-management, and endpoint-security environments to characterize commercially valuable hosts. It collects Chromium-based browser histories, searches for Brazilian CNAB financial-remittance files, and steals digital certificates. Its interactive capabilities include arbitrary shell-command execution, screenshot capture, and deployment of additional worker modules or payloads. Early versions establish persistence through Windows Registry Run keys, while console hiding, executable masquerading, and compilation support defense evasion.
The malware retrieves Base64-encoded, XOR-obfuscated command-and-control configuration through Pastebin dead drops and maintains bidirectional WebSocket communications over TLS. This configuration mechanism allows operators to change command infrastructure without rebuilding the payload. Activity is principally oriented toward Brazilian corporate environments, with broader Latin American and Iberian targeting. The exact initial infection vector is unconfirmed; observed distribution artifacts masqueraded as legitimate software or drivers, and associated VBS downloaders imitated Portuguese-language legal notifications.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
BraZetsu, a Python-based Windows malware framework compiled with Nuitka, is attributed with high confidence to the Brazilian threat actor Exilware and linked to the Infected Marketplace, which sells access to compromised Windows hosts.
BraZetsu, an initial access broker tool, targets Windows machines, specifically looking for ERP software, SCADA systems, and EDR products.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
WHOIS records the creation of installscenter.com on 21 March 2026, through Tucows.
The cluster likely moved from Contabo (AS51167) to Njalla (AS39287).
Resource Development VPS / Domains / Malware T1583.003 / T1583.001 / T1588.001
«В настоящее время точный способ распространения BraZetsu неизвестен, но исследователи считают наиболее вероятным вариантом социальную инженерию.»
Execution / Persistence Interpreter / Run key T1059 / T1547.001
The TTP list explicitly identifies T1059.001 — Command and Scripting Interpreter: PowerShell.
The run_shell_commands function executes arbitrary commands through the Windows Command Shell (cmd.exe).
Group-IB identified Visual Basic Script files associated with the distribution infrastructure that download subsequent attack stages.
Vecteur initial : ingénierie sociale probable, fichiers VBS masqués en notifications légales (portugais).
v1 persistence HKCU Run \ MonitorSystem
v1 persistence HKCU Run \ MonitorSystem
get_server_config() fetches a Pastebin blob, Base64-decodes it and XOR-decrypts with p4st3_s3cr3t_k3y.
Langage : Python 3, compilé avec Nuitka en exécutables PE natifs; the TTP list identifies T1027.002 — Software Packing.
distribution filenames (msedge[0-9].exe, wifi_driver.exe)
The report identifies filenames such as msedge04.exe, msedge[0-9].exe, and wifi_driver.exe, including a loader masquerading as Microsoft Edge.
The _dec() function subsequently Base64 decodes the data and decrypts it using XOR with the hardcoded key p4st3_s3cr3t_k3y.
BraZetsu also contains a hide_console function designed to conceal console-window activity during execution.
The agent profiles ERP ... EDR, .pfx/.p12 certificates and CNAB files, and returns a dossier.
«собирает цифровые сертификаты».
«делает скриншоты и отслеживает активное в данный момент окно».
It queries Windows uninstall registry locations to enumerate installed applications.
BraZetsu collects ... network-related information ... [and checks] ports ... and other indicators.
BraZetsu incorporates functions to enumerate environment variables, network ports, and running processes, alongside network infrastructure mapping.
«изучает переменные окружения, открытые порты и процессы».
It ... examines active processes ... The checks include ... processes associated with SAP, TOTVS, Warsaw, and other financial software.
BraZetsu collects basic host information including the username, hostname, operating system version ... and network-related information.
BraZetsu searches recursively for .PFX and .P12 digital certificate files within user profiles and OneDrive locations. The framework searches for CNAB files.
Look for unsigned executables compiled with Nuitka, Chromium History files copied into %TEMP%.
The agent profiles ERP (TOTVS, SAP, Senior, Conta Azul, Sankhya), SCADA traces (WinCC, RSLogix, FactoryTalk), EDR.
The framework extracts browser histories, recursively searches for CNAB financial files and digital certificates, and monitors active banking windows.
Discovery / Collection Software, browser, screen T1518 / T1217 / T1113
BraZetsu facilitates autonomous data collection, including digital certificates, browser histories, financial files, recently opened files, and CNAB-related data.
The live channel is WebSocket over TLS on 8443.
Récupération de configuration : dead-drop via Pastebin (Base64 + XOR avec clé p4st3_s3cr3t_k3y).
C2 is not hardcoded in the binary. get_server_config() fetches a Pastebin blob.
Visual Basic Script files associated with the distribution infrastructure ... download subsequent attack stages.
Command and Control WebSocket, TLS, dead-drop T1071.001 / T1573 / T1102.001
Exfiltration Over C2 Channel T1041
35 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.