Banana RAT Retrieves a Per-Victim Payload Only Once

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•1

Detects a loader requesting a PHP payload with a generated host identifier and then writing a marker that prevents repeat delivery. This rule specifically looks for network connections initiated by executables like 'powershell', 'cmd', 'loader', or 'update' that include command-line arguments indicative of a PHP payload request with a unique identifier and a marker for single delivery.