Executive Summary
Analysis of two Banana RAT branches linked to a single staging server at 198[.]245[.]53[.]26 reveals a significant evolution in evasion and persistence techniques between May and June 2026. The malware, primarily targeting Brazilian financial institutions and Pix-related transactions, has transitioned from easily clusterable static artifacts to a more sophisticated, randomized deployment model.
Technically, the threat actors moved from using pseudo-Microsoft domains (e.g., windowns-cdn[.]com) to a dynamic C2 model where subdomains are generated based on the victim's MachineGuid and tunneled via WebSockets through Cloudflare. The discovery of backend tools like 'servidor_completo_pool.py' on the staging host suggests an automated Malware-as-a-Service (MaaS) operation capable of generating polymorphic payload variants on demand.
This evolution increases the difficulty of bulk network clustering and traditional IOC-based blocking. Organizations in the financial sector, particularly those operating in Latin America, should prioritize behavioral detections for anomalous scheduled tasks and non-standard WebSocket traffic.