SHADOW-WATER-063 Banana RAT — Brazilian Banking Trojan with FastAPI Polymorphism Panel, AES-256-CBC PowerShell Payloads, Fileless In-Memory C# Compilation, and PIX QR Code Interception — Threadlinqs Intelligence
As of 2026-05-30, SHADOW-WATER-063 Banana RAT — Brazilian Banking Trojan with FastAPI Polymorphism Panel, AES-256-CBC PowerShell Payloads, Fileless In-Memory C# Compilation, and PIX QR Code Interception is a high-severity malware threat attributed to SHADOW-WATER-063 (Brazil), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 34 indicators of compromise.
Threat ID: TL-2026-0534 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: SHADOW-WATER-063 · Brazil · FINANCIAL
Banana RAT is a Brazilian-Portuguese-language banking trojan tracked by Trend Micro under the activity cluster SHADOW-WATER-063 (internal codename 'Projeto Banana'). The operator runs a FastAPI-based
Trend Micro's TrendAI MDR team published an end-to-end teardown of SHADOW-WATER-063's Banana RAT on 2026-05-19 after a four-month investigation that included direct access to the operator's exposed build server at 24.199.90.58. The operation is a clear next-generation evolution of the 'Tetrade' family of Brazilian banking trojans (Grandoreiro, Mekotio, Casbaneiro, Guildma, CHAVECLOAK) but introduces three notable tradecraft innovations: industrial-scale per-victim polymorphism, fileless PowerShell-only execution, and PIX-aware overlay logic.
The build server runs a FastAPI application (servidor_completo_pool.py, monitor_pool.py) backed by a worker pool that pre-generates batches of 100-200 PowerShell payloads per affiliate folder. Each build is byte-unique: the loader stub is randomized (variable names, comment noise, junk operations) and the inner stage is encrypted with AES-256-CBC using a freshly generated key/IV pair embedded in the dropper. A stats-view.php dashboard tracks per-affiliate distribution counts and successful infections, mirroring the Mekotio operator workflow but at greater scale.
Initial access begins with a phishing message — usually delivered via WhatsApp, but also via email — claiming the recipient has an outstanding nota fiscal eletronica (NF-e) invoice. The lure attaches Consultar_NF-e.bat, a small CMD wrapper that pulls the encrypted PowerShell loader (st.txt, st.php, payload.php) from one of the operator-controlled domains (convitemundial2026[.]com, c[.]windowsk-cdn[.]com, windowsk-cdn[.]com). The .bat invokes powershell.exe with -ExecutionPolicy Bypass -WindowStyle Hidden and pipes the downloaded ciphertext into a decryptor that calls [ScriptBlock]::Create on the decrypted plaintext and pipes the result through IEX. No PowerShell script ever lands on disk; the only on-disk artifacts are the .bat, two staged blobs in C:\Users\Public\Documents\msedge.txt and C:\Users\<user>\AppData\Roaming\Microsoft\Diagnosis\ETW\msedgeupdate.txt (used as a configuration cache), and the csc.exe-compiled in-memory module written to %TEMP%.
The second stage is a PowerShell-orchestrated C# loader. Banana RAT writes a C# source string to memory, invokes csc.exe via System.CodeDom.Compiler.CodeDomProvider to compile it into a transient .dll, then reflectively loads it via [System.Reflection.Assembly]::Load. The compiled assembly hosts the actual RAT functionality, intentionally splitting the kill chain across PowerShell -> csc.exe -> .NET reflection to defeat static AMSI/AV signatures on the .NET implant itself. The loader also drops persistence: an HKCU\Software\Microsoft\Windows\CurrentVersion\Run value pointing back to the .bat staging file, and a scheduled task named 'MicrosoftEdgeUpdateTaskMachineUA' for redundancy.
Once running, the implant beacons over HTTPS (443/tcp) and HTTP (80/tcp) to the C&C, registering itself with a victim ID derived from MAC + username + hostname. The C&C protocol is JSON over POST with AES-256-CBC body encryption, the same key family as the dropper. Commands supported include: screen_stream (MJPEG-style frame push for live RDP-style viewing), keylog_dump, overlay_open (loads one of 16 HTML banking overlays from the embedded resource pool), pix_intercept (monitors clipboard and any open windows for PIX QR codes, decodes them with ZXing.Net, swaps the destination key with an operator-controlled key, and re-encodes), browser_cookie_steal, and reverse_proxy.
The PIX interception module is the most operationally novel component. PIX is Brazil's instant-payment system, and QR codes are the dominant point-of-sale and peer-to-peer flow. Banana RAT continuously scans clipboard contents and visible window bitmaps (via PrintWindow GDI calls) for content matching the PIX BR Code payload format (starts with '00020126'). When a match is found, the ZXing.Net decoder extracts the merchant PIX key, the operator substitutes their own attacker-controlled PIX key, the EMV-style CRC16 is recomputed, and th
Weaknesses (CWE)
CWE-506, CWE-94, CWE-78, CWE-829
Target sectors: financial, banking, retail-banking, fintech, individual-consumers
Target regions: Brazil, South America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 34 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566.001, T1566.003, T1059.001, T1059.003, T1204.002, T1106, T1547.001, T1053.005, T1027