Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
Banana RAT Evolves: Comparing Two Recent Branches Through ANY.RUN
Excerpt
Editor’s note: The analysis is authored by Moises Cerqueira, malware researcher & threat hunter. You can find Moises on LinkedIn and X . This analysis started with an exposed public index on 198[.]245[.]53[.]26, discovered via Shodan. What made it interesting was not just the server exposure itself, but the fact that it lets us compare two different Banana RAT branches tied to the same infrastructure. The older detonation, analyzed on May…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Attack Flow6 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 443c0a821c214471d74b51093ab3d69bb9bee54ded049e5abcda2551e4f12707 | Medium | Score 38/100 | First seen |
| SHA256 | bc4c29bc0c84ea18311fbadc508f6f3a9d84b54a456e672c2ab34d6b42f56c0c | Medium | Score 38/100 | First seen |
| SHA256 | d828949ade683cf3ac6d4260f946ca33ef861035051db07d3ee79ec75dd243b2 | Medium | Score 38/100 | First seen |
| MD5 | 52facc3b24f8bad9c5c56819e385f3a1 | Medium | Score 53/100 | First seen |
| IP | 104.21.39.21 | High | Score 58/100 | First seen |
| URL | http://198.245.53.26/st.php | High | Score 58/100 | First seen |
| URL | http://198.245.53.26/payload.php | High | Score 58/100 | First seen |
| Domain | ofuscador.py | High | Score 58/100 | First seen |
| SHA256 | e9d918ff5f7918cff1a3a23f3945058a66b56d6dd724066414c7e1cab95e166d | Medium | Score 38/100 | First seen |
| URL | http://198.245.53.26/st.txt';iex(irm | High | Score 58/100 | First seen |
| URL | http://198.245.53.26/st.txt | High | Score 58/100 | First seen |
| IP | 149.56.12.51 | High | Score 86/100 | First seen |
| IP | 172.67.142.55 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…