Banana RAT Campaign Exposed: Malware Builder Generates Fresh Variants on Demand A recent discovery by researcher Moises Cerqueira has uncovered a sophisticated upgrade to Banana RAT, a remote access trojan (RAT) linked to Brazilian banking fraud. The malware’s operators are now using an exposed backend server to dynamically generate new, obfuscated variants in real time, evading traditional detection methods. The exposed server, hosted at 198.245.53.26, functioned as a payload generator, running scripts like servidor_completo_pool.py to produce fresh malware batches. A secondary script, ofuscador.py, scrambled PowerShell commands into randomized sequences, ensuring each payload appeared unique while maintaining core malicious functionality. ### Key Findings from the Campaign - Two Distinct Versions Detected: Researchers at ANY.RUN analyzed two Banana RAT variants one from late May 2026 and another from early June 2026 both originating from the same infrastructure. - May Version: Used fixed file paths and a misspelled domain (c.windowns-cdn.com) to mimic legitimate Windows updates. Persistence relied on a scheduled task tied to a named executable (MicrosoftEdgeUpdateCore.exe). - June Version: Adopted randomized file names and folders, a VBS launcher, and system-level scheduled tasks for persistence. Communication shifted to encrypted WebSocket channels with hashed, machine-specific subdomains (testewin.com), complicating domain-based blocking. - Shared Infrastructure: Both versions retained a fallback C2 IP (149.56.12.51), linking them to the same operation. The newer variant also resolved to Cloudflare edge IPs (104.21.39.172, 67.142.55) for command-and-control (C2) traffic. ### Impact on Defenders Banana RAT’s on-demand regeneration undermines blocklist-based defenses, as each infection appears distinct. The exposed server provided defenders with a rare, real-time view of malware evolution, offering insights into how attackers refine evasion techniques. The trojan’s primary focus remains stealing banking credentials and hijacking payment transactions, posing a direct threat to financial institutions and users. ### Indicators of Compromise (IoCs) Security teams are advised to monitor for: - IPs: `198.245.53.26` (staging server), `149.56.12.51` (fallback C2), `104.21.39.172`/`67.142.55` (Cloudflare C2). - Domains: `c.windowns-cdn.com` (older), `testewin.com` and subdomains (newer). - Files: `Fatura-BtgPactual-22568.bat`, `msedgeupdate.txt`, `st.php.malw`, `payload_new.php.malw`, `c9dba5b0552d879be654.txt`, and `MicrosoftEdgeUpdateCore.exe`. The discovery highlights the growing sophistication of banking malware, where automated payload generation enables rapid adaptation to defensive measures.

New Ransomware Strains BQTLock and GREENBLOOD Showcase Evolving Threat Tactics Two advanced ransomware families, BQTLock and GREENBLOOD, have emerged with distinct strategies, complicating detection and response for cybersecurity teams. BQTLock operates as a stealthy espionage tool, embedding itself within legitimate system processes such as explorer.exe to evade detection. Using a Remcos payload, it bypasses traditional antivirus by masquerading as trusted Windows activity. The malware then executes a UAC bypass via *fodhelper.exe*, gaining elevated privileges without user interaction. Once persistent, it harvests credentials and screenshots, delaying encryption to maximize data theft before extortion. In contrast, GREENBLOOD prioritizes speed, leveraging Go-based ChaCha8 encryption to lock systems within minutes. It employs a "smash-and-grab" approach, deleting forensic evidence and pressuring victims via a TOR-based leak site. Unlike BQTLock’s slow infiltration, GREENBLOOD’s rapid execution leaves little time for intervention. Analysts at ANY.RUN uncovered these behaviors in sandbox environments, where real-time execution chains revealed critical early indicators such as unexpected process injections and rapid file modifications. Detecting these signs before encryption is key to containment, as both strains exploit gaps in traditional signature-based defenses. BQTLock’s persistence mechanisms and GREENBLOOD’s destructive speed highlight the need for behavioral monitoring and updated threat intelligence to counter these evolving threats. Organizations are advised to watch for anomalous interactions between explorer.exe and fodhelper.exe, along with the unique command-line patterns associated with these strains.