Indicators of Compromise

Domain

TLP:CLEAR

www.rbinternational.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

cdn.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

c.windowsk

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Environment.MachineName

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Environment.UserName

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

ZXing.NET

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

proteger.py

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

stats-reset.php

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

monitor.txt

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

http:///payload.php

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

http://convitemundial2026.com/Consultar_NF-e.bat

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

user32.ShowWindow

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Net.WebClient.DownloadFile

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

0.cs

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

msedgeupdate.txt

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

payload.php

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

stats-view.php

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

24.199.90.58

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

msedge.txt

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

st.php

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

e.bat

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Backdoor.PS1.BANANARAT

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

st.txt

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Trojan.PS1.BANANARAT

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

convitemundial2026.com

Inside Banana RAT: From Build Server to Banking Fraud

75% confidence

Added

2026-05-21

URL

TLP:CLEAR

https://convitemundial2026.com/Consultar_NF-e.bat

Inside Banana RAT: From Build Server to Banking Fraud

75% confidence

Added

2026-05-21

URL

TLP:CLEAR

http://24.199.90.58:80/payload.php

Inside Banana RAT: From Build Server to Banking Fraud

75% confidence

Added

2026-05-21

IPv4 Address

TLP:CLEAR

162.141.111.227

Inside Banana RAT: From Build Server to Banking Fraud

75% confidence

Added

2026-05-21

Domain

TLP:CLEAR

windowsk-cdn.com

Inside Banana RAT: From Build Server to Banking Fraud

75% confidence

Added

2026-05-21

Domain

TLP:CLEAR

c.windowsk-cdn.com

Inside Banana RAT: From Build Server to Banking Fraud

75% confidence

Added

2026-05-21

SHA-256 Hash

TLP:CLEAR

38dfeb772afbd01c04eddda120d283acfb1147a6dc3d54ac62fe23ad06e39d8f

Inside Banana RAT: From Build Server to Banking Fraud

75% confidence

Added

2026-05-21

SHA-256 Hash

TLP:CLEAR

4912b1134e69ade7266e8508eec33ccb2d80ad693f1dbc4f1f4344c6dfcf2ff1

Inside Banana RAT: From Build Server to Banking Fraud

75% confidence

Added

2026-05-21

SHA-256 Hash

TLP:CLEAR

d7545b6dacebdae27effb3c778c5e349027ec789c76ae4f777bd9ba56a70cdaa

Inside Banana RAT: From Build Server to Banking Fraud

75% confidence

Added

2026-05-21

SHA-256 Hash

TLP:CLEAR

ecdc8fade561a75d68235859ad8b1fe131db2c458b4894268e38e90ecab1c47f

Inside Banana RAT: From Build Server to Banking Fraud

75% confidence

Added

2026-05-21

URL

TLP:CLEAR

http://24.199.90.58/payload.php

Inside Banana RAT: From Build Server to Banking Fraud

75% confidence

Added

2026-05-21