{"id":21824,"date":"2026-07-07T14:02:31","date_gmt":"2026-07-07T14:02:31","guid":{"rendered":"https:\/\/any.run\/cybersecurity-blog\/?p=21824"},"modified":"2026-07-07T14:31:04","modified_gmt":"2026-07-07T14:31:04","slug":"banana-rat-evolution-analysis","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/banana-rat-evolution-analysis\/","title":{"rendered":"Banana RAT Evolves: Comparing Two Recent Branches Through ANY.RUN\u00a0"},"content":{"rendered":"\n

Editor\u2019s note: The analysis is authored by Moises Cerqueira, <\/strong><\/em>malware researcher & threat hunter. You can find Moises on LinkedIn<\/a> and X<\/a>.<\/em><\/strong><\/p>\n\n\n\n

This analysis started with an exposed public index on 198[.]245[.]53[.]26, discovered via Shodan. What made it interesting was not just the server exposure itself, but the fact that it lets us compare two different Banana RAT branches tied to the same infrastructure.<\/p>\n\n\n\n

The older detonation, analyzed on May 25, 2026, used an ETW-themed installation path and fake Microsoft naming. The newer detonation, analyzed on June 09, 2026, moved to randomized installation identifiers, VBS-assisted persistence, and WebSocket C2 over a hashed testewin.com subdomain.<\/strong><\/p>\n\n\n\n

That difference is important. Instead of seeing a single sample in isolation, we can see how the malware evolved while keeping the same staging host. This gives defenders more than a one-off IOC list: it shows how the operator changed persistence, transport, and artifact naming between two live branches.<\/p>\n\n\n\n

This article focuses on three questions:<\/p>\n\n\n\n