ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 149.56.12.51:443.

Database Entry


IOC ID:1854535
IOC: 149.56.12.51:443
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : True
ASN:AS16276 OVH
Country:- FR
First seen:2026-07-21 05:20:24 UTC
Last seen:never
UUID:20b73d57-847e-11f1-8973-42010aa4000a
Reporter DENNISAROSS
Reward 5 credits from ThreatFox
Tags:BananaRAT banking-trojan BL-Networks brazil powershell
Reference: https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/

Avatar
DENNISAROSS
Banana RAT infrastructure. 149.56.12.51:443 = hardcoded fallback C2 IP (OVH Montreal), confirmed in OTX pulse 'Banana RAT Evolves'. 162.33.178.68:80 = payload delivery / staging server (BL Networks AS399629) hosting msedge.txt PowerShell RAT client and Aviso.html BB phishing lure. Also hosts servidor_completo_pool.py FastAPI C2 server on port 8888 (uvicorn). Targets Brazilian banking sector.