Banana RAT Initiates a Vishing Support Workflow
Detects the malware presenting telephone or support instructions after blocking banking access, encouraging the victim to contact an attacker-controlled operator. This rule specifically looks for process creation events where the executable name matches common RAT naming conventions (banana, client, update, service) and the command line contains keywords related to calling support or telephone numbers, often in the context of banking or security issues.
CQL
