ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 162.33.178.68:80.

Database Entry


IOC ID:1854536
IOC: 162.33.178.68:80
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : True
ASN:AS399629 BLNWX
Country:- NL
First seen:2026-07-21 05:20:23 UTC
Last seen:never
UUID:20cf6f6f-847e-11f1-8973-42010aa4000a
Reporter DENNISAROSS
Reward 5 credits from ThreatFox
Tags:BananaRAT banking-trojan BL-Networks brazil powershell
Reference: https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/

Avatar
DENNISAROSS
Banana RAT infrastructure. 149.56.12.51:443 = hardcoded fallback C2 IP (OVH Montreal), confirmed in OTX pulse 'Banana RAT Evolves'. 162.33.178.68:80 = payload delivery / staging server (BL Networks AS399629) hosting msedge.txt PowerShell RAT client and Aviso.html BB phishing lure. Also hosts servidor_completo_pool.py FastAPI C2 server on port 8888 (uvicorn). Targets Brazilian banking sector.