ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain testewin.com.

Database Entry


IOC ID:1854534
IOC: testewin.com
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : True
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-07-21 05:20:25 UTC
Last seen:never
UUID:1b83c9eb-847e-11f1-8973-42010aa4000a
Reporter DENNISAROSS
Reward 5 credits from ThreatFox
Tags:BananaRAT banking-trojan BL-Networks brazil Cloudflare-Tunnel powershell
Reference: https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/

Avatar
DENNISAROSS
Banana RAT C2 domain using Cloudflare Tunnel. Unique victim subdomains generated from MachineGuid MD5 hash (e.g. [md5hash].testewin.com). Fallback: cdn.testewin.com. Port 443. Protocol magic: 0x4C 0x51 0x57 0x50 (LQWP), version 11.07-FAST-RECONNECT. Extracted from msedge.txt PowerShell RAT client staged at 162.33.178.68. VT: 5 malicious (Sophos: spyware and malware). Targets Brazilian banks: BB, Bradesco, Itau, Santander, Caixa, Safra, Daycoval, Banrisul, Sicoob, Sicredi + crypto exchanges.