4912b1134e69ade7266e8508eec33ccb2d80ad693f1dbc4f1f4344c6dfcf2ff1SHA-256 hash

Reported by 1 independent source · first reported 19 May 2026 by Trend Micro Research · last reported 19 May 2026

Last reported 5 months ago

What the reports say

1 report, newest first · the exact sentence from each

“4912b1134e69ade7266e8508eec33ccb2d80ad693f1dbc4f1f4344c6dfcf2ff1”

Trend Micro ResearchVendor19 May 2026
Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud

Indicators reported together

named in the same reports

162.141.111[.]227in 1 report
hxxps://convitemundial2026[.]com/Consultar_NF-e.batin 1 report
convitemundial2026[.]comin 1 report
hxxp://24.199.90[.]58/payload.phpin 1 report
24.199.90[.]58in 1 report
windowsk-cdn[.]comin 1 report
c.windowsk-cdn[.]comin 1 report
cdn[.]comin 1 report
ecdc8fade561a75d…e90ecab1c47fin 1 report
38dfeb772afbd01c…23ad06e39d8fin 1 report
d7545b6dacebdae2…9ba56a70cdaain 1 report

Copy these 11 indicators · defanged

11 indicators, defanged, one per line

162.141.111[.]227
hxxps://convitemundial2026[.]com/Consultar_NF-e.bat
convitemundial2026[.]com
hxxp://24.199.90[.]58/payload.php
24.199.90[.]58
windowsk-cdn[.]com
c.windowsk-cdn[.]com
cdn[.]com
ecdc8fade561a75d68235859ad8b1fe131db2c458b4894268e38e90ecab1c47f
38dfeb772afbd01c04eddda120d283acfb1147a6dc3d54ac62fe23ad06e39d8f
d7545b6dacebdae27effb3c778c5e349027ec789c76ae4f777bd9ba56a70cdaa

Thanks — we review every report.

Report a wrong value