Saefko: A new multi-layered RAT

Zscaler ThreatLabZ analyzed Saefko, a .NET remote-access trojan sold on dark web marketplaces that persists via autostart registry keys, profiles victims by parsing browser history (credit-card, crypto, shopping, business, social/gaming categories), and can exfiltrate screenshots, webcam video, keylogs, and system/location info to HTTP/IRC command-and-control servers; it also supports USB propagation and remote payload execution. The report provides detailed technical behavior, command lists, required libraries, sample IOCs (MD5s, downloader and network URLs), and recommended mitigations.