bratarfood.com: an open folder that handed out Windows malware files (AzaleaAgent, CoinMiner), and what to do if a PC fetched them

What bratarfood.com is, and what we know about it

bratarfood.com is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware files were served from an open folder. We found no public write-up of this one address, so what follows is what URLhaus shows, what our own request returned, and what security vendors have published about the malware names in the tags.

1. 1

   What URLhaus lists

   Twelve file addresses, all inside the folder /new/ on bratarfood.com, all added on 23 September 2026 between about 09:52 and 10:08 UTC by the reporter abuse_ch. They are eight programs (alibaba.exe, masa.exe, msc.exe, agents.exe, msn.exe, mns_protected.exe, baidu.exe and microsoft.exe), one batch script (alibaba.bat) and three text files (XWormClientupload.txt, agentupload.txt and playload12upload.txt). All carry the threat label malware_download and all 12 are marked offline.

2. 2

   What the tags mean

   opendir means the folder could be listed by anyone, which is how a whole set of files was found within minutes. AzaleaAgent is on four programs (alibaba.exe, mns_protected.exe, baidu.exe and microsoft.exe); it is a name linked to the Azalea remote access trojan. CoinMiner is on agents.exe and microsoft.exe and means a program that mines cryptocurrency on someone else's PC. The three .txt files carry the tags ascii, Encoded and rev-base64-loader, which describe text that is written backwards in base64 and is turned into a program by a script.

3. 3

   What we could not confirm

   We did not download any file, so we cannot tell you what is inside, which builds they are, or where they report to. The file name XWormClientupload.txt suggests XWorm, a remote access trojan, but URLhaus did not put XWorm in the tags, so that is a hint from a name, not a proof. We also do not know which message or program makes a victim's PC ask for these files.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a Windows PC where something already ran and went to fetch one of these files. Nobody opens a folder like /new/ by hand to read a menu; a program does it.

Kind of threat

A server with an open folder of malware files: programs tagged AzaleaAgent and CoinMiner, a batch script and three encoded loader text files

Where the files were

hxxps://bratarfood[.]com/new/NAME: ordinary https on the normal port, in one folder called new

Domain registered

31 July 2026 through NameCheap, Inc.; status client transfer prohibited (RDAP, read 17 October 2026)

URLhaus entries

12 file addresses, all added on 23 September 2026; all 12 offline when we read our copy of the data on 17 October 2026

Delivery trick

Staging in an open folder, plus text files holding reversed base64 that a script rebuilds into a program. The entry step on the victim's PC is not known

Platform

Windows. The files are .exe, .bat and loader text for Windows scripts. Nothing we read says Mac, iPhone or Android are affected

What we checked on 17 October 2026, and what we could not

Our check was one plain request from our server, with no browser and no clicks. It returned HTTP status 200 and a page titled Index of /, served by LiteSpeed. That is a bare file listing, not a website. It clears nothing.

What happened to bratarfood.com, from registration to our check

This is a young domain. It was registered about eight weeks before the reports, and all 12 reports fall within sixteen minutes. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 31 July 2026

   The domain is registered

   RDAP shows bratarfood.com registered on 31 July 2026 at about 15:20 UTC through NameCheap, Inc. The only status is client transfer prohibited, which is a normal registrar lock and says nothing about the content.

2. 23 September 2026, 09:52 UTC

   The first loader files are reported

   abuse.ch adds alibaba.bat, playload12upload.txt and agentupload.txt within about a minute. The two text files are tagged ascii, Encoded and rev-base64-loader; the batch file is tagged bat and opendir.

3. 23 September 2026, 09:53 UTC

   Eight programs are reported in about six seconds

   microsoft.exe, baidu.exe, mns_protected.exe, msn.exe, agents.exe, msc.exe, masa.exe and alibaba.exe are added between 09:53:13 and 09:53:18. Four carry AzaleaAgent, two carry CoinMiner (microsoft.exe carries both), and msn.exe, msc.exe and masa.exe carry only exe and opendir.

4. 23 September 2026, 10:08 UTC

   The last file, with an XWorm name

   XWormClientupload.txt is added at about 10:08 UTC with the loader tags ascii, Encoded and rev-base64-loader. Its name points to XWorm, but the tags do not.

5. 17 October 2026

   All offline, front page still a listing

   All 12 entries are marked offline in our copy of the data. Our plain request to the home page the same day still returned a directory listing with status 200.

   

What the pattern suggests, and what it does not: a new domain whose whole content was reported in one sweep looks like a staging server set up to hold tools, with a folder anyone could browse. That is our reading of the dates and the tags, not something any report says. We do not know who runs it, and the domain may be hacked rather than built for this.

The 12 files, one by one

The list below is what URLhaus shows for each address. The tags are labels from the reporter and from matching, not a proof of what a file does, and we opened none of them.

How the files fit together: a loader, an agent and a miner

We did not see how a PC reaches this folder, and no vendor has written about this address. The chain below is built from the file names, the tags and from what vendors describe for the same malware names, so treat it as a model of what is likely, not a record of what happened.

1. 1

   A first program is already running

   Nothing in the reports says how. Vendors describe a phishing attachment, a shortcut file or a downloaded script as the usual start. That first program then asks a server for the next piece, and here the server is bratarfood.com.

2. 2

   A text file is fetched and rebuilt

   Public analyses of XWorm batch to PowerShell chains describe embedded base64 that is cleaned, reversed and decoded to rebuild a .NET program, which then resolves to XWorm. The rev-base64-loader tag on the three .txt files fits this pattern. The file looks like harmless text, so a filter that only checks file type sees nothing wrong.

3. 3

   The program starts and stays

   Logpoint lists three ways XWorm keeps itself on a PC: a file in the Startup folder, a scheduled task and a registry Run key. Point Wild, quoted by Expert Insights, reports a scheduled task called UpdateTask for two Azalea samples. Whether the files here do the same is not confirmed.

4. 4

   A person or a miner takes over

   A remote access trojan lets someone else use the PC. A coin miner uses your processor and power to earn money for someone else. Both can run on the same PC, which is why the tags AzaleaAgent and CoinMiner on one file (microsoft.exe) matter.

What AzaleaAgent, XWorm and a coin miner are

The three names are different things. The sources agree on what they can do and differ on what each campaign adds. None of these sources looked at the files on bratarfood.com.

What these programs can take from a Windows PC

A remote access trojan gives a person a seat at your computer, so the list below is what such a person can do rather than what one build does by itself. A miner takes power, not data.

What this can cost you

Seeing the name costs nothing. The risks below apply to a Windows PC where one of these files ran.

• High

  Passwords and accounts

  A keylogger records what you type into every site, including new passwords you set. Changing passwords on the infected PC does not help; the person watching sees them too.

• High

  Someone using your PC live

  A remote access trojan is not a one time theft. The controller can come back at any time and act while you are signed in.

• High

  A work network

  Expert Insights reports Active Directory discovery for Azalea. A PC that belongs to a company should go to the IT team at once, not be cleaned alone.

• Medium

  A slow, hot PC and a higher power bill

  A miner uses the processor for someone else's gain. It rarely steals data, but it means someone else had control of the PC.

• Medium

  More malware on the same PC

  Loaders in these chains download further tools, and the tags show at least two kinds of payload on one server.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Remote access trojans are built to be quiet. The signs below come from the sources and from what they imply; none is certain, and many victims notice nothing.

How a PC ends up asking for these files

Nobody visits bratarfood.com/new/ on purpose. The request comes from a program, so the real question is how that program got on the PC. We cannot say for this server; the routes below are the ones vendors found with the same families.

1. 1

   A script or batch file from an email

   Public analyses of XWorm describe a phishing attachment that is a BAT script, which starts PowerShell to fetch a base64 payload that turns into XWorm. Opening the attachment is what starts it.

2. 2

   A shortcut file that downloads the next stage

   Expert Insights describes an Azalea sample that came through a malicious shortcut using curl.

3. 3

   A file that poses as a known program

   Names such as microsoft.exe, baidu.exe and alibaba.exe borrow trusted brands. A file that claims to come from a big company but sits on an unknown server is a warning in itself.

Check your PC before you delete anything

Start with the question that matters: did something on this PC contact bratarfood.com, or did you open an unexpected attachment, shortcut, script or installer? If you saw the name in a log from your own network, the device that asked is the one to check. None of the checks below deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A remote access trojan needs the connection to be used.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.

3. 3

   Look at Task Manager

   Press Ctrl+Shift+Esc, open the Processes tab and sort by CPU. A program you do not know that keeps the processor busy while you do nothing is a candidate for a miner. Right-click it and choose Open file location to see where it lives. Do not end it or delete it yet; write down the name and the folder.

4. 4

   Open Task Scheduler

   Press Start, type Task Scheduler and open it. Look in Task Scheduler Library for tasks you do not know, with random names or a name like UpdateTask that runs a script or a program from a user folder. Logpoint and Expert Insights both name scheduled tasks as a way these families stay. Write the name and the program it runs.

5. 5

   Look at Startup apps and the Startup folder

   Open Settings > Apps > Startup and switch off nothing yet; just look for names you did not install. Then press Windows key + R, type shell:startup and press Enter, to see the Startup folder. Logpoint names that folder as a place where XWorm copies itself.

6. 6

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time of first contact. Microsoft says the results of an offline scan also appear there. A clean list does not clear the PC.

7. 7

   Check your accounts from another device

   Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check.

8. 8

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result like a clean site test: one data point. We did not infect a PC, so the order of the plan is our judgement from Microsoft's pages, not a tested result.

If you use a Mac, an iPhone or an Android phone

The files are .exe programs, a .bat script and Windows loader text. We found nothing that says they affect anything else.