Banana RAT Deletes Temporary Screens and Overlay Assets
Detects cleanup of captured frames, QR images, overlay resources, or decrypted modules after a banking fraud session, specifically targeting files with names containing 'screen', 'frame', 'overlay', 'qr', 'module', or 'stage' and extensions like '.png', '.jpg', '.bmp', '.dll', '.dat', '.bin' within common temporary or application data directories. The activity is attributed to processes with 'banana', 'client', 'update', or 'service' in their base file name.
CQL
