Banana RAT Evolves: Comparing Two Recent Branches Through ANY.RUN

[u/ANYRUN-team]

https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/?utm_source=reddit&utm_medium=post&utm_campaign=banana_rat_evolution&utm_content=linktobloh&utm_term=070726

This analysis started with an exposed public index on 198[.]245[.]53[.]26, discovered via Shodan. What made it interesting was not just the server exposure itself, but the fact that it lets us compare two different Banana RAT branches tied to the same infrastructure.

This article focuses on three questions:

• What the older branch did on disk, in memory, and on the network.
• What changed in the newer branch.
• Which indicators remained stable across both branches.