Researchers Map Banana RAT’s End-to-End Operation Targeting Brazilian Banks

May 19, 2026 · Original article ↗

Summary

Trend Micro researchers mapped Banana RAT’s delivery infrastructure and victim-side execution, detailing its polymorphic PowerShell payloads, remote-control capabilities, Pix QR interception, and targeting of Brazilian financial institutions.

Key points

Researchers correlated artifacts recovered from attacker infrastructure with endpoint telemetry to reconstruct the Banana RAT operation, tracked as SHADOW-WATER-063.
The campaign lures users into running a malicious invoice-themed batch file, which launches PowerShell to download and execute further payloads.
A server-side build system generates unique, obfuscated payloads; the malware uses AES-wrapped code and fileless PowerShell execution.
Banana RAT supports screen streaming, remote input, keylogging, clipboard manipulation, file exfiltration, and bank-themed overlays.
Its Pix QR detection and manipulation features, along with a list of Brazilian financial targets, point to a focus on financial fraud in Brazil.
The malware establishes hidden scheduled-task persistence and communicates with operator infrastructure over encrypted command-and-control channels.
The report says the C&C infrastructure was active at publication; it recommends user-awareness training and current EDR coverage.

Article Details

Attack Vectors: Users in Brazil’s financial sector were lured via WhatsApp or a possible phishing URL to download and execute Consultar_NF-e.bat from convitemundial2026[.]com.
The batch file launches obfuscated PowerShell, which downloads and executes a second-stage payload in memory; the malware also uses AES-wrapped, polymorphic payload builds.
Banana RAT establishes persistence with a hidden scheduled task and communicates with operator infrastructure to receive instructions and exfiltrate captured data.
The malware supports operator-driven banking fraud through keylogging, screen streaming, remote input control, deceptive bank overlays, and Pix QR-code interception.
Defensive Notes: Train users not to download or execute commands such as PowerShell, Run-dialog input, or terminal commands in response to website, security-tool, or CAPTCHA instructions.
Warn users about unexpected full-screen banking overlays and requests to scan QR codes.
Maintain actively deployed, up-to-date EDR sensors with real-time behavioral monitoring.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`c[.]windowsk-cdn[.]com`	Primary C&C domain used by Banana RAT.
DOMAIN	`convitemundial2026[.]com`	Campaign-specific domain used to distribute the malicious batch file.
DOMAIN	`windowsk-cdn[.]com`	Typosquatting domain identified as part of the malware’s C&C infrastructure.
IPV4	`162[.]141[.]111[.]227`	Fallback C&C IP address.
IPV4	`24[.]199[.]90[.]58`	Attacker-controlled host used for payload staging and C&C infrastructure.
SHA256	`38dfeb772afbd01c04eddda120d283acfb1147a6dc3d54ac62fe23ad06e39d8f`	SHA-256 hash of the malicious st.php downloader.
SHA256	`4912b1134e69ade7266e8508eec33ccb2d80ad693f1dbc4f1f4344c6dfcf2ff1`	SHA-256 hash of the malicious payload.php dropper.
SHA256	`d7545b6dacebdae27effb3c778c5e349027ec789c76ae4f777bd9ba56a70cdaa`	SHA-256 hash of the Banana RAT msedge.txt payload.
SHA256	`ecdc8fade561a75d68235859ad8b1fe131db2c458b4894268e38e90ecab1c47f`	SHA-256 hash of the malicious st.txt downloader.
URL	`hxxp[:]//24[.]199[.]90[.]58/payload[.]php`	Stager URL used to retrieve the next-stage payload.
URL	`hxxps[:]//convitemundial2026[.]com/Consultar_NF-e[.]bat`	Payload-delivery URL for the malicious batch file.