24.199.90[.]58IP address
Reported by 1 independent source · first reported by Trend Micro Research · last reported
Last reported 5 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud“…e console window via user32.ShowWindow, creates C:\Users\Public\Documents\ if absent, downloads the next-stage PowerShell from hxxp://24.199.90[.]58/payload.php using Net.WebClient.DownloadFile, and executes the downloaded payload via IEX of a freshly created ScriptBlock.”
Indicators reported together
named in the same reports- 162.141.111[.]227in 1 report
- hxxps://convitemundial2026[.]com/Consultar_NF-e.batin 1 report
- convitemundial2026[.]comin 1 report
- hxxp://24.199.90[.]58/payload.phpin 1 report
- windowsk-cdn[.]comin 1 report
- c.windowsk-cdn[.]comin 1 report
- cdn[.]comin 1 report
- ecdc8fade561a75d…e90ecab1c47fin 1 report
- 38dfeb772afbd01c…23ad06e39d8fin 1 report
- 4912b1134e69ade7…44c6dfcf2ff1in 1 report
- d7545b6dacebdae2…9ba56a70cdaain 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.