Banana RAT is a sophisticated Brazilian banking trojan linked to the SHADOW-WATER-063 cluster. It features a FastAPI-based polymorphic payload generation system that produces hash-unique builds to avoid detection. The malware uses layered obfuscation techniques, AES-wrapped payloads, and fileless PowerShell execution to maintain stealth. Once deployed, it facilitates operator-driven fraud through multiple capabilities including remote input control, keylogging, screen streaming, bank-branded overlays, and Pix QR code interception. The trojan exclusively targets 16 Brazilian banks and cryptocurrency exchanges. Operator artifacts are in Brazilian Portuguese, indicating a financially motivated actor operating within the Tetrade banking trojan ecosystem. Indicators include domains, IP addresses, URLs, and file hashes associated with the malware infrastructure. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

The malware enables financially motivated fraud targeting Brazilian banks and crypto exchanges by allowing attackers to remotely control infected systems, capture keystrokes, stream screens, overlay fake banking interfaces, and intercept Pix QR codes. This can lead to unauthorized transactions and financial theft from victims. The targeting is highly specific to Brazilian financial institutions, increasing the risk to customers of those entities. There is no evidence of widespread exploitation beyond this targeted scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is malware with no direct patch, mitigation should focus on detection and removal using updated endpoint protection solutions capable of identifying polymorphic payloads and fileless PowerShell activity. Network defenses should monitor and block known malicious domains, IPs, and URLs associated with the threat. User education on phishing and suspicious downloads is recommended to reduce infection risk. No official fix or vendor advisory is currently available.