Pulse Detail — Threat Intelligence

PULSE NAME

Inside Banana RAT: From Build Server to Banking Fraud

WHITE SHADOW-WATER-063 Tr1sa111 2026-05-21 Modified: 2026-05-21

IOCs

MEDIUM VOLUME

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

MALWARE FAMILIES

Banana RAT Grandoreiro - S0531 Mekotio Metamorfo - S0455 Casbaneiro Astaroth - S0373 Guildma CHAVECLOAK

Indicators of Compromise (3 / 11 total)

All FileHash-SHA256 IPv4 URL domain hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
URL	http://24.199.90.58/payload.php	—	2026-05-21
URL	http://24.199.90.58:80/payload.php	—	2026-05-21
URL	https://convitemundial2026.com/Consultar_NF-e.bat	—	2026-05-21

References (1)