Brazilian Access Broker Targeting Latin America: Mapping BraZetsu Infrastructure via TLS Certificates

    Monday, October 12, 2026 In: Threat Research Print

    Date: 10/12/2026

    Severity: High

    Summary

    BraZetsu, a Python-based Windows malware framework compiled with Nuitka, is attributed with high confidence to the Brazilian threat actor Exilware and linked to the Infected Marketplace, which sells access to compromised Windows hosts. Infrastructure analysis revealed that its C2 hostname, c2.installscenter.com, shared hosting with a control panel using Hestia Control Panel ports 8083 and 8443, with TLS certificates helping track infrastructure changes across VPS providers. Despite rotating malware hashes and Pastebin dead-drop URLs, consistent certificate patterns, hostnames, and panel configurations indicate possible operator continuity across infrastructure migrations.

    Indicators of Compromise (IOC) List 

    Domains/URLs

    c2.installscenter.com

    infect.online

    infectonline.store

    painel.installscenter.com

    painel.seu-dominio.com

    caixaentradas1inboxshop.site

    https://pastebin.com/raw/aF0WCxia

    https://pastebin.com/raw/hM0nXNBP

    https://pastebin.com/raw/9ChwVzzw

    IP Address

    38.242.246.176

    80.78.27.252

    Hash

    0C65D06ECD5A4BCD214128CC5AE2FD48F449A7B0E4002C6F0E127486B90DF1B5

    731F269E44E3372E214E48EBAF0A05A892E914422A1FA664FB25A0FE2200528A

    473ADE701A602A14D50A869762DF72D1A1CA7CD395BF26B9E090D9116A447726

    AB5C83564A38A035819A601E2E2F40C4AD07D0C12625BBB196AB4E915B087F86

    f775fe06a4c2563cb03e1aa42eb4e9532840cce9dc168ea2ca97cee7972e6b17

    54e313434a7f3fa349e439857e23ab536a95c9927cf62f8358b5cdd9fabf2700

    91f225dcc7a01f926b03e8540d8b5e2d6c8e3763cc30f57381d702ce638fa6b0

    cd8fc8effea20d28e76c53f3386c783e55dcb309e1525b27f7a141d51b6f6c78

    d881a60ccd03b5417a1eed184143a18a333e7e9e9e351596a7a765843643af99

    0fa785bb9f95b113539bb909da88e6cac9a433a07935571d9bcd2d85746fc5bf

    1510823e7c80b4db5333dd18cd5992881496da30032d6d69b2a82e1c5cf30246

    96960409b6e1abf20eeb689d9e0a170008a15096de6a06ca5ae0d5aa56579042

    0cd0cc49ea4ff48c675368f725e183608494f22fefa92d2f33577f70bb6c0d5d

    30af2ec2437af0f4910d528440715540dbec6a5587f86f327316a7a781c1e2fe

    10de6185e31539cf01c8b05d9559e65e8693efd695f315de54667ef8c04de39c

    bc91f90a5677404cf9c8f4bed7b36c22027b1549ffefee129b41fab3db3108b8

    93bb4a4812e77ddc17c2722340d915bd5c8387316bbdbc394c201a28cb9b7c88

    67fcfbdaab397ad1273135a3c6aa1d220ab76491cf945df081503401cc9732d2

    c4dd46e5b450349fd9fbf686a5a22f55f8371123b098104db663a3980646e138

    3f2f48525cf082672e38808480e214775e03dd943ff2df86172665aad96a5eaa

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection        

    Detection Query 1 :

    domainname like "https://pastebin.com/raw/aF0WCxia" or url like "https://pastebin.com/raw/aF0WCxia" or siteurl like "https://pastebin.com/raw/aF0WCxia" or domainname like "infect.online" or url like "infect.online" or siteurl like "infect.online" or domainname like "painel.seu-dominio.com" or url like "painel.seu-dominio.com" or siteurl like "painel.seu-dominio.com" or domainname like "https://pastebin.com/raw/hM0nXNBP" or url like "https://pastebin.com/raw/hM0nXNBP" or siteurl like "https://pastebin.com/raw/hM0nXNBP" or domainname like "painel.installscenter.com" or url like "painel.installscenter.com" or siteurl like "painel.installscenter.com" or domainname like "c2.installscenter.com" or url like "c2.installscenter.com" or siteurl like "c2.installscenter.com" or domainname like "caixaentradas1inboxshop.site" or url like "caixaentradas1inboxshop.site" or siteurl like "caixaentradas1inboxshop.site" or domainname like "https://pastebin.com/raw/9ChwVzzw" or url like "https://pastebin.com/raw/9ChwVzzw" or siteurl like "https://pastebin.com/raw/9ChwVzzw" or domainname like "infectonline.store" or url like "infectonline.store" or siteurl like "infectonline.store"

    Detection Query 2 :

    dstipaddress IN ("80.78.27.252","38.242.246.176") or srcipaddress IN ("80.78.27.252","38.242.246.176")

    Detection Query 3 :

    sha256hash IN ("54e313434a7f3fa349e439857e23ab536a95c9927cf62f8358b5cdd9fabf2700","d881a60ccd03b5417a1eed184143a18a333e7e9e9e351596a7a765843643af99","93bb4a4812e77ddc17c2722340d915bd5c8387316bbdbc394c201a28cb9b7c88","f775fe06a4c2563cb03e1aa42eb4e9532840cce9dc168ea2ca97cee7972e6b17","67fcfbdaab397ad1273135a3c6aa1d220ab76491cf945df081503401cc9732d2","1510823e7c80b4db5333dd18cd5992881496da30032d6d69b2a82e1c5cf30246","cd8fc8effea20d28e76c53f3386c783e55dcb309e1525b27f7a141d51b6f6c78","3f2f48525cf082672e38808480e214775e03dd943ff2df86172665aad96a5eaa","10de6185e31539cf01c8b05d9559e65e8693efd695f315de54667ef8c04de39c","bc91f90a5677404cf9c8f4bed7b36c22027b1549ffefee129b41fab3db3108b8","0cd0cc49ea4ff48c675368f725e183608494f22fefa92d2f33577f70bb6c0d5d","91f225dcc7a01f926b03e8540d8b5e2d6c8e3763cc30f57381d702ce638fa6b0","0fa785bb9f95b113539bb909da88e6cac9a433a07935571d9bcd2d85746fc5bf","30af2ec2437af0f4910d528440715540dbec6a5587f86f327316a7a781c1e2fe","96960409b6e1abf20eeb689d9e0a170008a15096de6a06ca5ae0d5aa56579042","c4dd46e5b450349fd9fbf686a5a22f55f8371123b098104db663a3980646e138","0C65D06ECD5A4BCD214128CC5AE2FD48F449A7B0E4002C6F0E127486B90DF1B5","731F269E44E3372E214E48EBAF0A05A892E914422A1FA664FB25A0FE2200528A","473ADE701A602A14D50A869762DF72D1A1CA7CD395BF26B9E090D9116A447726","AB5C83564A38A035819A601E2E2F40C4AD07D0C12625BBB196AB4E915B087F86")

    Reference:

    Brazilian Access Broker Targeting Latin America


    Tags

    MalwareTreat ActorPythonBrazilLatin America

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.