MalwareUsed by 1 actor

Banana RAT

Banana RAT is a Windows remote access trojan and banking malware associated with Brazilian banking fraud and tracked in some reporting under the threat cluster SHADOW-WATER-063. It is delivered through Brazilian invoice-themed lures, especially fake NF-e (Nota Fiscal Eletronica) documents, including malicious batch files such as Consultar_NF-e.bat and Fatura-BtgPactual-22568.bat distributed via phishing links or WhatsApp. The infection chain uses hidden PowerShell staging to retrieve additional components such as st.txt, st.php, payload.php, and msedge.txt, with payloads described as AES-256 encrypted, decrypted in memory, and generated polymorphically to produce byte-unique variants. Reported staging and infrastructure include 198[.]245[.]53[.]26, 24[.]199[.]90[.]58, c.windowns-cdn.com, c.windowsk-cdn.com, windowsk-cdn[.]com, testewin.com, cdn.testewin.com, and fallback IPs including 149[.]56[.]12[.]51 and 162.141.111[.]227. Observed persistence includes hidden scheduled tasks, including SYSTEM-level scheduled tasks in newer variants, and fallback Run key persistence under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Newer branches used randomized installation folders and filenames, a VBS launcher written under ProgramData, and encrypted WebSocket C2 over host-derived subdomains based on MD5(MachineGuid).testewin.com; older branches used fixed Microsoft-themed filenames and ETW-themed paths together with pseudo-Microsoft C2 domains. Across reporting, Banana RAT is described as a full-featured banking-oriented RAT capable of stealing banking credentials, interfering with payment transactions, keylogging, screen and session monitoring, screen capture or streaming, remote input control, file transfer and enumeration, system and process discovery, and banking-overlay or Pix QR-code manipulation for fraud. It is reported to target Brazilian financial activity, including banking sessions, Pix-related transactions, major Brazilian banks, and localized cryptocurrency exchanges. High-confidence file and artifact indicators mentioned in the content include Consultar_NF-e.bat, Fatura-BtgPactual-22568.bat, st.txt, st.php, payload.php, msedge.txt, MicrosoftEdgeUpdateCore.exe, c9dba5b0552d.vbs, st.php.malw, and payload_new.php.malw.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

SHADOW-WATER-063

A newly discovered banking trojan is targeting Brazilians by disguising itself as a legitimate electronic invoice. The malware, known as Banana RAT, uses fake NF-e (Nota Fiscal Eletronica) documents to trick victims into running malicious batch files that quietly install a powerful remote access tool on their Windows systems.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

24 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.001DomainsEvidence1

It also uses a typosquatting domain designed to impersonate legitimate Microsoft CDN infrastructure...

Initial Access

2 techniques

T1566PhishingEvidence1

Attackers are counting on that familiarity, sending lure files with the name “Consultar_NF-e.bat” through WhatsApp messages or phishing links.

T1566.002Spearphishing LinkEvidence1

MITRE ATT&CK ID Technique T1566.002 Phishing: Spearphishing Link

Execution

5 techniques

T1053.005Scheduled TaskEvidence4

Persistence relied on a scheduled task tied to a named executable... the newer version... shifts to a VBS launcher paired with a hidden scheduled task running with system-level privileges.

T1059Command and Scripting InterpreterEvidence1

ANY.RUN behavior showed: hidden PowerShell execution, base64-encoded PowerShell, task-scheduler-backed execution

T1059.001PowerShellEvidence5

ofuscador.py, which took plain PowerShell commands and rewrote them into a scrambled character sequence reassembled and run at execution time.

T1059.005Visual BasicEvidence3

The newer version, seen in early June... persistence shifts to a VBS launcher paired with a hidden scheduled task running with system-level privileges.

T1204.002Malicious FileEvidence1

The attack begins when a victim downloads and runs the malicious batch file, which triggers a hidden PowerShell command.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence4

Persistence relied on a scheduled task tied to a named executable... the newer version... shifts to a VBS launcher paired with a hidden scheduled task running with system-level privileges.

T1547.001Registry Run Keys / Startup FolderEvidence2

If the malware is not elevated yet, it supports a fallback under HKCU\Software\Microsoft\Windows\CurrentVersion\Run — the sample can survive under the user context first, then migrate into a SYSTEM-level scheduled task later.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence4

Persistence relied on a scheduled task tied to a named executable... the newer version... shifts to a VBS launcher paired with a hidden scheduled task running with system-level privileges.

T1547.001Registry Run Keys / Startup FolderEvidence2

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence4

Sitting alongside it was a second script, ofuscador.py, which took plain PowerShell commands and rewrote them into a scrambled character sequence reassembled and run at execution time.

T1036MasqueradingEvidence3

The earlier version... relied on fixed file names and folder paths designed to look like legitimate Windows update components. It used a lookalike domain with a spelling error...

T1140Deobfuscate/Decode Files or InformationEvidence2

MITRE ATT&CK Mapping Tactic Technique ID Evidence Defense Evasion Deobfuscate/Decode Files or Information T1140 Memory-side invocation of base64-decoded wrappers and .NET reflection for sensitive API calls.

T1218System Binary Proxy ExecutionEvidence1

Runtime C# compilation via csc.exe and cvtres.exe

T1564.001Hidden Files and DirectoriesEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Evidence Defense Evasion Hide Artifacts: Hidden Files and Directories T1564.001 Target payload files and persistence launchers utilize system attributes and restricted paths.

Credential Access

2 techniques

T1056Input CaptureEvidence1

It streams the victim’s screen live to the operator, logs every keystroke, injects fake banking overlays...

T1056.001KeyloggingEvidence3

Capability Assessment Based on payload content, sandbox behavior, and prior branch context, this branch supports: ... Key input tracking and screen capture / overlay workflows

Discovery

3 techniques

T1057Process DiscoveryEvidence2

Capability Assessment Based on payload content, sandbox behavior, and prior branch context, this branch supports: ... System and process discovery

T1082System Information DiscoveryEvidence2

Capability Assessment Based on payload content, sandbox behavior, and prior branch context, this branch supports: ... System and process discovery

T1083File and Directory DiscoveryEvidence1

Capability Assessment Based on payload content, sandbox behavior, and prior branch context, this branch supports: ... File transfer and enumeration

Collection

3 techniques

T1056Input CaptureEvidence1

It streams the victim’s screen live to the operator, logs every keystroke, injects fake banking overlays...

T1056.001KeyloggingEvidence3

Capability Assessment Based on payload content, sandbox behavior, and prior branch context, this branch supports: ... Key input tracking and screen capture / overlay workflows

T1113Screen CaptureEvidence2

Capability Assessment Based on payload content, sandbox behavior, and prior branch context, this branch supports: ... Key input tracking and screen capture / overlay workflows

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

The malware connects back to its command-and-control server on port 443 using a custom binary protocol encrypted with AES-256-CBC.

T1071.001Web ProtocolsEvidence3

Communication with attacker servers happens over an encrypted WebSocket channel, using an address built from a hashed identifier unique to each infected computer...

T1105Ingress Tool TransferEvidence3

The exposed server ran a script called servidor_completo_pool.py, a backend service built to pre-generate malware payloads in batches... and serve finished files.

T1568Dynamic ResolutionEvidence2

using an address built from a hashed identifier unique to each infected computer, making simple domain blocking far less effective.

INDICATORS OF COMPROMISE

IOCs tracked for this family

36 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

18 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

9 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

domain●●●●●●●●●●●●View more in apptoday

ip.v4●●●●●●●●●●●●View more in apptoday

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

cyber security newsNews

Jul 8, 2026

Banana RAT Uses Exposed Payload Generator to Create Polymorphic Banking Malware Variants

Banana RAT is a remote access trojan associated with Brazilian banking fraud. It targets financial activity by stealing banking credentials and interfering with payment transactions, and in this campaign it used exposed backend infrastructure to generate and obfuscate fresh payload variants on demand for evasion.

medium anyrunNews

Jul 7, 2026

Banana RAT Evolves: Comparing Two Recent Branches Through ANY.RUN | by ANY.RUN | Jul, 2026 | Medium

A banking-oriented remote access payload used to target Brazilian financial activity. The article describes two evolving branches with hidden PowerShell staging, persistence via Scheduled Task and Run key fallback, WebSocket C2, screen and session monitoring, remote input capability, system and process discovery, file transfer and enumeration, key input tracking, screen capture/overlay workflows, and runtime C# compilation.

anyrun blogNews

Jul 7, 2026

Banana RAT Evolves: Comparing Branches Through ANY.RUN

A fully featured banking-oriented remote access payload targeting Brazilian financial activity. The article describes capabilities including hidden PowerShell staging, scheduled task and Run key persistence, WebSocket C2, screen and session monitoring, remote input, system and process discovery, file transfer, keylogging, screen capture, and runtime C# compilation.

trojan killer newsNews

Jul 6, 2026

TimbreStealer Hides Behind Edge and Google Update DLLs

Mentioned only as related guide content for a Brazilian banking trojan tied to Pix fraud.

+4 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching36

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping24

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Banana RAT