Banana RAT Branches Show New Persistence and WebSocket C2 Techniques
Summary
Analysis of two Banana RAT branches found shared staging infrastructure but changes in installation paths, persistence, and C2. The newer branch uses randomized identifiers, a VBS launcher, scheduled tasks, and WebSocket communications.
Key points
- An exposed server at 198.245.53.26 hosted staging files and backend scripts consistent with generating and obfuscating payload variants.
- The older branch used ETW-themed paths, Microsoft-like filenames, and the C2 domain c.windowns-cdn.com, resolving to 149.56.12.51.
- The newer branch uses randomized ProgramData paths, a VBS launcher, a hidden SYSTEM scheduled task, and a registry Run-key fallback.
- The newer payload communicates over WebSockets with host-specific subdomains under testewin.com; its fallback IP, 149.56.12.51, links it to the older branch.
- Analysis describes capabilities including screen and session monitoring, remote input, file transfer, system discovery, and keylogging.
- The recovered runtime payload matched the newer branch's analyzed payload by SHA-256, connecting the exposed infrastructure to sandbox observations.
Article Details
- Attack Vectors
- PowerShell-based staging retrieves and executes payloads from the exposed staging host.
- A BAT launcher reconstructs and executes PowerShell commands; the newer branch uses a VBS launcher.
- Persistence uses hidden Scheduled Tasks running as SYSTEM, with an HKCU Run-key fallback when elevated privileges are unavailable.
- The newer branch communicates with C2 over WebSockets and supports keylogging, screen capture, remote input, and file transfer.
- Defensive Notes
- Monitor for hidden PowerShell execution, VBS launchers, suspicious Scheduled Tasks, and Run-key persistence.
- Hunt for the article-listed staging and C2 indicators, including the dedicated testewin.com domain and the cross-branch fallback IP.
- The article recommends using sandbox detonation and threat-intelligence enrichment to investigate suspicious files and URLs.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 52facc3b24f8bad9c5c56819e385f3a1[.]testewin[.]com | Victim-specific C2 domain used by the newer branch for WebSocket communication. |
| DOMAIN | c[.]windowns-cdn[.]com | Pseudo-Microsoft C2 hostname used by the older Banana RAT branch. |
| DOMAIN | cdn[.]testewin[.]com | Fallback C2 domain embedded in the newer-branch runtime payload. |
| IPV4 | 149[.]56[.]12[.]51 | Older-branch C2 address and fallback C2 IP in the newer branch. |
| IPV4 | 198[.]245[.]53[.]26 | Exposed staging and payload-distribution host used by both Banana RAT branches. |
| MD5 | e3f81120502a2945f3f0eaabc28e6d3f | Example suspicious file hash associated in the article with a Banana RAT attack. |
| SHA256 | 443c0a821c214471d74b51093ab3d69bb9bee54ded049e5abcda2551e4f12707 | SHA-256 of the older-branch full payload, identified as msedgeupdate.txt / msedge.txt. |
| SHA256 | bc4c29bc0c84ea18311fbadc508f6f3a9d84b54a456e672c2ab34d6b42f56c0c | SHA-256 of Fatura-BtgPactual-22568.bat, identified as the older-branch entry sample. |
| SHA256 | d828949ade683cf3ac6d4260f946ca33ef861035051db07d3ee79ec75dd243b2 | SHA-256 of payload_new.php.malw, identified as the newer-branch full PowerShell payload and matching the extracted runtime payload. |
| SHA256 | e9d918ff5f7918cff1a3a23f3945058a66b56d6dd724066414c7e1cab95e166d | SHA-256 of st.php.malw, identified as the newer-branch stage-2 stager. |
| URL | hxxp[:]//198[.]245[.]53[.]26/payload[.]php | Older-branch payload-delivery URL on the exposed malware staging host. |
| URL | hxxp[:]//198[.]245[.]53[.]26/st[.]php | Newer-branch staging URL used to retrieve and execute the stage. |
| URL | hxxp[:]//198[.]245[.]53[.]26/st[.]txt | Older-branch staging URL used to retrieve a file from the exposed malware staging host. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes character-reconstruction obfuscation and backend string transformations.T1053.005 · Scheduled TaskThe newer branch creates a hidden Scheduled Task configured to run at startup as SYSTEM.T1056.001 · KeyloggingThe payload monitors keyboard input to capture banking credentials.T1057 · Process DiscoveryThe payload checks running processes against local defense-process lists.T1059.001 · PowerShellThe branches use hidden PowerShell staging and execution, including dynamically assembled commands.T1059.005 · Visual BasicA standalone VBS wrapper launches the newer-branch payload from ProgramData.T1071.001 · Web ProtocolsThe newer branch uses WebSocket communication over wss on port 443 for C2.T1082 · System Information DiscoveryThe newer payload extracts MachineGuid and environment flags to generate host-specific parameters.T1113 · Screen CaptureThe payload performs screen capture using in-memory .NET reflection.T1140 · Deobfuscate/Decode Files or InformationThe article reports in-memory invocation of base64-decoded wrappers and .NET reflection.T1547.001 · Registry Run Keys / Startup FolderThe newer branch can use the HKCU CurrentVersion\Run key as fallback persistence.T1564.001 · Hidden Files and DirectoriesThe article reports hidden payload files and persistence launchers placed in restricted paths.
People
Malware
Tools
ofuscador.pyThe public index on 198[.]245[.]53[.]26 exposed not only stage files such as st.php, st2.txt, and msedge.txt, but also operational tooling such as servidor_completo_pool.py and ofuscador.py.servidor_completo_pool.pyThe public index on 198[.]245[.]53[.]26 exposed not only stage files such as st.php, st2.txt, and msedge.txt, but also operational tooling such as servidor_completo_pool.py and ofuscador.py.