Banana RAT Decrypts AES-CBC Content in PowerShell

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•4

Detects PowerShell constructing an AES object in CBC mode and decrypting bytes before dynamic script execution, indicative of malware like Banana RAT.