During a recent Managed Detection and Response (MDR) engagement, security analysts successfully recovered both halves of an active cyber operation: the attacker’s server-side tooling from their delivery infrastructure and the client-side malware from compromised endpoints. Capturing both sides of an operation simultaneously is an extremely rare occurrence. This complete acquisition allows the threat’s full operating model to be thoroughly mapped out rather than inferred. The structural layout captures a strict trust boundary separating attacker-controlled infrastructure on the left from victim-side execution on the right.

The operational geometry intentionally segregates delivery pipelines from command-and-control (C&C) infrastructure. This design ensures high resilience; if the delivery host is taken down, existing infections continue communicating with the C&C host unaffected, and if the C&C host is disrupted, the delivery pipeline remains functional for subsequent campaigns. For defenders, this geometry isolates intervention points: blocking the single crossing connection at the network perimeter stops new infections cleanly, whereas remediation requires direct action against the separate C&C channel that lies entirely outside the initial delivery frame.

The Server-Side Polymorphic Engine and MaaS Panel

On the server side, recovered between 17 and 22 April 2026, the operator maintains a clean, unobfuscated PowerShell banker named msedge.txt as a master source file. This master source code is never delivered directly to victims. Instead, it feeds a FastAPI-based server-side crypter panel that applies nine sequential in-house obfuscation layers and an AES-256-CBC wrapper to generate polymorphic builds. To serve incoming requests instantly, the engine maintains a pre-generated pool of 100 to 200 ready, hash-unique builds per delivery folder, continuously refreshed by four parallel generator threads at startup or generated in under one second if the pool is empty. Served exactly once per victim request as payload.php, each sample is entirely byte-unique across variable names, function names, .NET type-name fragmentation, junk-code insertions, XOR keys, and encrypted code blobs, rendering signature-based file-hash detection impossible at population scale.

The server infrastructure, hosted at 24.199.90[.]58:80, exposes web-accessible endpoints for payload staging, victim management, and operational control under an Apache server environment. Recovered files include server-side orchestration logic (servidor_completo_pool.py), monitoring/session management (monitor_pool.py), a deployment setup script (instalar_completo_pool.sh), a tracking statistics reset script (stats-reset.php), and a configuration marker document (monitor.txt). The backend features a custom administrative analytics dashboard branded as “Download Analytics v2.0”. Utilizing an Outfit/Space Mono font palette, a violet-emerald color scheme, a 30-second auto-refresh, and a Brazilian-Portuguese confirmation modal (Resetar Dados?), it ingests web logs to give operators real-time campaign reach statistics broken down by country, ISP, operating system, and client. This significant UI investment strongly suggests a Malware-as-a-Service (MaaS) model targeting affiliates.

Initial Access, Fileless Delivery, and Evasion Tactics

The campaign uses localized lures targeting corporate users in Brazil’s financial sector. Disguised as an electronic invoice file named Consultar_NF-e.bat, it is downloaded from the URL hxxps://convitemundial2026[.]com/Consultar_NF-e[.]bat, leveraging corporate familiarity with Brazil’s Nota Fiscal Eletrônica (NF-e) invoicing system. When a user executes the malicious batch file, it spawns an initial 490-byte PowerShell stager snippet (st.txt) or a larger proxy-resilient variant (st.php using Start-BitsTransfer with a WebClient fallback for content filtering). The stager hides its console window via user32.ShowWindow, creates the directory C:\Users\Public\Documents\ if absent, and executes a single HTTP GET request to download payload.php from the host hxxp://24[.]199[.]90[.]58/payload[.]php using Net.WebClient.DownloadFile.

The downloaded payload is written to a world-writable path as a text document disguise at C:\Users\Public\Documents\msedge.txt. The stager then loads the file into memory, decrypts the AES-wrapped body using an embedded key and IV, and executes the plaintext via ScriptBlock::Create. This fileless pattern ensures the decrypted banker never touches disk, bypassing standard Antimalware Scan Interface (AMSI) detections of raw objects (objectRawDataStr). For defense evasion, telemetry reveals the malware copies its staged payload into a path mimicking legitimate Microsoft diagnostic storage, specifically writing to C:\Users\70397\AppData\Roaming\Microsoft\Diagnosis\ETW\msedgeupdate[.]txt from the parent batch command.

Persistence is established by invoking PS_ScheduledTask.ExecMethod(RegisterByUser), which registers a hidden scheduled task. Configured to run every minute for 9,999 days and hidden from standard Task Scheduler views, it executes powershell.exe with -WindowStyle Hidden and -ExecutionPolicy Bypass. This wrapper command enforces single-instance execution via a local PID file and dynamically executes the second-stage payload from msedge.txt using IEX under a hidden process.

Deconstructing the Agent: In-Memory .NET Modules and Capabilities

Currently detected as Backdoor.PS1.BANANARAT.A or Trojan.PS1.BANANARAT.A, the core PowerShell script delivers a fully featured banking remote access trojan (RAT). To build up its complex functionality across multiple Add-Type calls, the script invokes csc.exe from the .NET Framework directory to dynamically compile temporary C# source files (.cs) inside the user’s Temp directory. Compilation generates several short-lived files: .0.cs (C# source code written by PowerShell), .cmdline (arguments passed to csc.exe), .tmp (temporary working file), .dll (compiled .NET assembly output loaded into memory), .out (standard compiler output), and .err (compiler errors).

The agent assembles five distinct native .NET assemblies to drive its malicious features:

• Display Overlay Module: Launches a separate UI thread to construct a borderless form covering the entire display. Using low-level Windows APIs, it forces the window to remain “always on top,” prevents it from being captured or easily closed, and makes it click-through. It displays fake full-screen interfaces complete with animated loading indicators and progress bars to mimic Windows updates, system repairs, blue screen errors, or bank-branded security pages, blocking all user interaction until explicitly hidden via the Hide method.
• Input Tracker Module: Directs a high-priority background thread to continuously monitor keyboard input by directly querying low-level key states using Windows API functions (GetAsyncKeyState). It compares current key states with previous states to capture new key presses, accounts for Shift and Caps Lock modifiers, and logs readable characters into a 2,000-entry internal ring buffer queue retrieved and cleared by the operator on demand.
• NativeInput Module: Wraps low-level user32.dll Win32 functions (SetCursorPos, mouse_event, keybd_event) to programmatically inject mouse movements, clicks, scrolls, and keystrokes. Crucially, it invokes BlockInput(true) to freeze the victim’s physical keyboard and mouse, briefly unblocking input only to inject its own automated events before re-blocking to maintain complete system override.
• Window Monitor Module: Takes snapshots of the display using Windows GDI graphics functions. The GrabEznn method accepts width and height constraints, copies pixels from the screen’s top-left corner into a compatible memory space via BitBlt, outputs a Bitmap object, and cleans up graphics resources to avoid memory leaks. Frames are continuously streamed as compressed JPEGs to the operator.
• QROverlay Module: Designed explicitly for QR-based phishing (“quishing”), this module renders a borderless banking-style overlay window complete with customizable bank names, theme colors, and a social-engineering QR prompt instructing the victim to “confirm identity,” tricking users into scanning malicious payment destinations.

The fully unpacked banker integrates these modules with supplementary backdoor capabilities. It performs clipboard monitoring to read and replace copied data (such as crypto wallet addresses) , pushes chat popups to execute real-time social engineering , and carries out directory listings, file exfiltration, and process or service enumeration. When running under service permissions, its ExplorerSpawner component duplicates the SYSTEM token and spawns an interactive PowerShell process inside the user’s desktop session (Session 0 token theft).

Command and Control Protocol Architecture

The malware establishes an outbound TCP session to the active command-and-control host on port 443. It initiates DNS resolution attempts (up to three retries) for its primary C&C typosquatting domain, c[.]windowsk-cdn[.]com (crafted to impersonate Microsoft CDN infrastructure), before automatically reverting to a hardcoded fallback IP address: 162.141.111[.]227. Communication uses a custom binary C&C protocol over encrypted TCP.

All commands, exfiltrated keystrokes, and clipboard data are encrypted using AES-256-CBC, with keys derived via SHA-256 from a static, hardcoded cryptographic master key: iuhbdaubdvauygd5562$3@##$r. Client identification and session validation require an initial HMAC-SHA256 authentication token derived from the victim’s machine GUID and MAC address.

Attribution: The “Projeto Banana” and Tetrade Convergence

TrendAI™ tracks this activity cluster under the temporary designation SHADOW-WATER-063. Static analysis of the Python panel, the server-side polymorphism engine, and the PowerShell stagers yields a moderate-confidence attribution pointing to a financially motivated, Brazilian Portuguese-speaking actor. This assessment converges on several undeniable observations:

• Exclusively Localized Targeting: The script maintains a curated array named $script:MonitorDomains that constantly polls GetForegroundWindow titles. It checks titles against more than 30 target banking pages, covering the four largest Brazilian financial segments: private retail giants (Itaú, Bradesco, Santander Brasil, Safra), the federal-public banking system (Caixa, Banco do Brasil), regional tiers (Banrisul, Daycoval), and cooperative financial networks (Sicoob, Sicredi). No foreign or non-Brazilian institutions are present in the list. Furthermore, specific string directives like BrowserOnlyDomains = @('CAIXA', 'Santander', 'Banco do Brasil') reveal customized per-institution behavior tuning.
• Language and Code Base Fingerprints: Every server-side file comment, runtime status string, filename, and log message is written entirely in Brazilian Portuguese without diacritics (e.g., using “Voce” and “seguranca” instead of “Você” and “segurança”). Naming conventions lean heavily on Portuguese verbs, referencing a parent script named proteger.py (“protector”) alongside regional banking terms like Pessoa Juridica (PJ), Conta Corrente, Atendimento, and Pix.
• Maintained Code Base Identifiers: The engine stamps every served payload with an internal project codename header: # PROTECTED SCRIPT v4.0 - Projeto Banana (MSEDGE EDITION). The versioning and the (MSEDGE EDITION) qualifier reveal a maintained product line rather than an isolated campaign. Internally, the client identifies its versions as SMART_V27_ULTRA and BUILD_V6_HARDCODED_TYPES to counteract analyst tracking.

Most notably, the malware contains a dedicated Pix-QR interception subsystem. Pix is the central bank instant-payment rail operating exclusively within Brazil. The agent reflectively loads a dynamically downloaded copy of ZXing.NET (zxing*.dll) to scan, decode, and hot-swap payment QR codes displayed on the victim’s monitor, transmitting actions using dedicated C&C opcodes 0x64 through 0x67 (AutoQRToggle, QRCodeDetected, ShowQROverlay, HideQROverlay). Additionally, the full-screen social engineering overlays match verbatim lures used by prolific Brazilian banking syndicates: “Atualização de Segurança obrigatória – NÃO DESLIGUE O COMPUTADOR” (Mandatory Security Update – DO NOT TURN OFF YOUR COMPUTER), running the victim through four fake stages (verifying OS, downloading security module, validating digital certificates, applying update) while the operator performs fraudulent actions in the background.

While alternative explanations like a foreign actor leveraging localized toolkits cannot be entirely ruled out, the toolchain sits directly within the broader “Tetrade” banking-trojan ecosystem (encompassing Grandoreiro, Mekotio, Casbaneiro, Guildma, Javali, and CHAVECLOAK). However, architectural design distinguishes it from canonical Tetrade threats. While Grandoreiro relies on a monolithic Delphi-compiled binary, Banana RAT implements a highly agile, panel-grade MaaS infrastructure utilizing a Python/FastAPI polymorphism engine and a fileless PowerShell client, sharing no known infrastructure indicators with active FLUXROOT (Google TAG), TA2725 (Proofpoint), or UNC5176 campaigns. The absence of espionage modules, destructive logic, or ransomware confirms that SHADOW-WATER-063 is exclusively a fraud-execution platform.

Our Opinion on This Case

The discovery of Banana RAT represents a major paradigm shift within the Latin American financial threat landscape. For years, security teams have treated Brazilian banking trojans as loud, monolithic Delphi binaries that relied heavily on human-driven interaction. Banana RAT completely upends this convention. By decoupling the delivery pipeline from the command-and-control backbone, the threat actor achieves an exceptional level of operational resilience. If a hosting provider takes down the staging files, the active infections remain completely unimpeded, allowing long-running fraud campaigns to persist uninterrupted.

The most concerning development is the integration of a panel-grade, FastAPI-driven server-side polymorphism engine. By managing a continuous, thread-warmed pool of ready payloads, the operators have successfully commoditized byte-uniqueness. This completely neutralizes traditional signature-based file-hash identification at population scale. Furthermore, the choice to execute modules via dynamic, in-memory C# compilation using native binaries (csc.exe) demonstrates sophisticated defense evasion. This guarantees that the core fraud scripts never leave an identifiable footprint on local storage, effectively blinding standard endpoint inspection tools.

The tactical focus on localized payment rails—specifically the automated Pix QR code hot-swapping mechanism—underscores a highly specialized, financially motivated adversary that builds tooling around region-specific transaction workflows. As these operators transition toward structured Malware-as-a-Service (MaaS) distribution frameworks, we expect to see an explosion of independent criminal affiliates leveraging this platform. Defenders cannot rely on static security indicators; addressing threats like Banana RAT requires robust behavior-based endpoint detection alongside network perimeter blocking to disrupt the critical delivery threshold before in-memory execution takes root.