Banana RAT Detects a Target Banking Website
Detects a non-browser process reading active browser titles, URLs, or accessibility trees and matching Brazilian bank names before activating fraud modules. Specifically, it looks for processes named 'banana', 'client', 'update', or 'service' (case-insensitive) that are executing commands related to UI automation or window title retrieval, and simultaneously searching for banking-related keywords like 'bank', 'internet banking', 'agencia', or 'conta'.
CQL
