A publicly indexed server at 198[.]245[.]53[.]26, discovered via Shodan, exposed more than simple staging files it revealed an active payload-generation backend and obfuscation tooling tied to two distinct Banana RAT branches. The host served static stages (st.txt, payload.php) and a FastAPI-based builder (servidor_completo_pool.py) plus an ofuscador.py helper. Enabling researchers to compare an older ETW-themed branch […]
The post Exposed Banana RAT Infrastructure Reveals Payload Generator and Obfuscator Tooling appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.