Malware

AgenteV2

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059.001PowerShellEvidence1

The TTP list explicitly identifies T1059.001 — Command and Scripting Interpreter: PowerShell.

T1059.003Windows Command ShellEvidence2

The framework supports « exécution de commandes shell distantes »; the TTP list identifies T1059.003.

T1204.002Malicious FileEvidence2

Vecteur initial : ingénierie sociale probable, fichiers VBS masqués en notifications légales (portugais).

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Persistance : clé de registre Run nommée « MonitorSystem » (v1).

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Persistance : clé de registre Run nommée « MonitorSystem » (v1).

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

get_server_config() retrieves base64-encoded C2 configuration from Pastebin; _dec() decodes and XOR decrypts it using the hardcoded key p4st3_s3cr3t_k3y.

T1027.002Software PackingEvidence2

Langage : Python 3, compilé avec Nuitka en exécutables PE natifs; the TTP list identifies T1027.002 — Software Packing.

T1036.005Match Legitimate Resource Name or LocationEvidence1

The report identifies filenames such as msedge04.exe, msedge[0-9].exe, and wifi_driver.exe, including a loader masquerading as Microsoft Edge.

T1564.003Hidden WindowEvidence1

The TTP list explicitly identifies T1564.003 — Hide Artifacts: Hidden Window.

Discovery

7 techniques

T1010Application Window DiscoveryEvidence1

BraZetsu obtains the user's active application window title and checks whether it contains common banking keywords.

T1012Query RegistryEvidence1

The TTP list explicitly identifies T1012 — Query Registry.

T1057Process DiscoveryEvidence1

The TTP list explicitly identifies T1057 — Process Discovery; the framework also monitors active banking windows.

T1082System Information DiscoveryEvidence1

BraZetsu conducts deep reconnaissance and uses AI-driven assessment through hardware profiling and software-environment analysis to determine a compromised machine's commercial value.

T1083File and Directory DiscoveryEvidence1

Recherche de fichiers financiers CNAB (.rem, .ret, .cnab, .240, .400) and recursive extraction of .pfx and .p12 certificates.

T1217Browser Information DiscoveryEvidence2

It enumerates browser profiles and queries SQLite history databases for URLs, titles, and visit counts.

T1518Software DiscoveryEvidence1

The TTP list explicitly identifies T1518 — Software Discovery; IAB profiling detects categories including SCADA, EDR, ERP, healthcare, logistics, ISPs, and cryptocurrency.

Collection

2 techniques

T1005Data from Local SystemEvidence1

The framework extracts browser histories, recursively searches for CNAB financial files and digital certificates, and monitors active banking windows.

T1113Screen CaptureEvidence3

« Capture d’écran (SD/HD) » is listed among the framework's reconnaissance capabilities.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

BraZetsu establishes a persistent WebSocket connection to C2; BraZetsu and AgenteV2 establish an interactive WebSocket backdoor over TLS port 8443.

T1102Web ServiceEvidence1

Récupération de configuration : dead-drop via Pastebin (Base64 + XOR avec clé p4st3_s3cr3t_k3y).

T1102.001Dead Drop ResolverEvidence1

BraZetsu retrieves encrypted C2 configuration from specified Pastebin URLs; both BraZetsu and AgenteV2 retrieve C2 configuration through Pastebin dead-drop resolvers.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Communication C2 : WebSocket persistant sur TLS port 8443; internal strings indicate a server-side AI engine to sort and prioritize stolen data.

INDICATORS OF COMPROMISE

IOCs tracked for this family

20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

16 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app21 days ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

polyswarmNews

Sep 11, 2026

BraZetsu: AI-Enhanced Reconnaissance Fuels Exilware’s Access Marketplace

Related malware activity sharing a browser-database copying technique with BraZetsu; no further functionality is described.

xakepNews

Sep 4, 2026

Вредонос BraZetsu оценивает жертв с помощью ИИ и продает доступ к их системам - Хакер

A Python backdoor previously deployed against Brazilian users through phishing campaigns. The content identifies infrastructure and code links between it and BraZetsu.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching20

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

AgenteV2

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059.001PowerShellEvidence1

The TTP list explicitly identifies T1059.001 — Command and Scripting Interpreter: PowerShell.

T1059.003Windows Command ShellEvidence2

The framework supports « exécution de commandes shell distantes »; the TTP list identifies T1059.003.

T1204.002Malicious FileEvidence2

Vecteur initial : ingénierie sociale probable, fichiers VBS masqués en notifications légales (portugais).

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Persistance : clé de registre Run nommée « MonitorSystem » (v1).

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Persistance : clé de registre Run nommée « MonitorSystem » (v1).

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

get_server_config() retrieves base64-encoded C2 configuration from Pastebin; _dec() decodes and XOR decrypts it using the hardcoded key p4st3_s3cr3t_k3y.

T1027.002Software PackingEvidence2

Langage : Python 3, compilé avec Nuitka en exécutables PE natifs; the TTP list identifies T1027.002 — Software Packing.

T1036.005Match Legitimate Resource Name or LocationEvidence1

The report identifies filenames such as msedge04.exe, msedge[0-9].exe, and wifi_driver.exe, including a loader masquerading as Microsoft Edge.

T1564.003Hidden WindowEvidence1

The TTP list explicitly identifies T1564.003 — Hide Artifacts: Hidden Window.

Discovery

7 techniques

T1010Application Window DiscoveryEvidence1

BraZetsu obtains the user's active application window title and checks whether it contains common banking keywords.

T1012Query RegistryEvidence1

The TTP list explicitly identifies T1012 — Query Registry.

T1057Process DiscoveryEvidence1

The TTP list explicitly identifies T1057 — Process Discovery; the framework also monitors active banking windows.

T1082System Information DiscoveryEvidence1

BraZetsu conducts deep reconnaissance and uses AI-driven assessment through hardware profiling and software-environment analysis to determine a compromised machine's commercial value.

T1083File and Directory DiscoveryEvidence1

Recherche de fichiers financiers CNAB (.rem, .ret, .cnab, .240, .400) and recursive extraction of .pfx and .p12 certificates.

T1217Browser Information DiscoveryEvidence2

It enumerates browser profiles and queries SQLite history databases for URLs, titles, and visit counts.

T1518Software DiscoveryEvidence1

The TTP list explicitly identifies T1518 — Software Discovery; IAB profiling detects categories including SCADA, EDR, ERP, healthcare, logistics, ISPs, and cryptocurrency.

Collection

2 techniques

T1005Data from Local SystemEvidence1

The framework extracts browser histories, recursively searches for CNAB financial files and digital certificates, and monitors active banking windows.

T1113Screen CaptureEvidence3

« Capture d’écran (SD/HD) » is listed among the framework's reconnaissance capabilities.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

BraZetsu establishes a persistent WebSocket connection to C2; BraZetsu and AgenteV2 establish an interactive WebSocket backdoor over TLS port 8443.

T1102Web ServiceEvidence1

Récupération de configuration : dead-drop via Pastebin (Base64 + XOR avec clé p4st3_s3cr3t_k3y).

T1102.001Dead Drop ResolverEvidence1

BraZetsu retrieves encrypted C2 configuration from specified Pastebin URLs; both BraZetsu and AgenteV2 retrieve C2 configuration through Pastebin dead-drop resolvers.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Communication C2 : WebSocket persistant sur TLS port 8443; internal strings indicate a server-side AI engine to sort and prioritize stolen data.

INDICATORS OF COMPROMISE

IOCs tracked for this family

20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

16 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app21 days ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

polyswarmNews

Sep 11, 2026

BraZetsu: AI-Enhanced Reconnaissance Fuels Exilware’s Access Marketplace

Related malware activity sharing a browser-database copying technique with BraZetsu; no further functionality is described.

xakepNews

Sep 4, 2026

Вредонос BraZetsu оценивает жертв с помощью ИИ и продает доступ к их системам - Хакер

A Python backdoor previously deployed against Brazilian users through phishing campaigns. The content identifies infrastructure and code links between it and BraZetsu.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching20

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.