Banatrix – an indepth look

Banatrix is a technologically advanced Polish banking malware that persists via dropped DLL/EXE pairs, communicates with C2 through a TOR-based proxy and a custom DGA, and downloads xor-encrypted libraries that allow arbitrary code execution. Its payloads include browser-memory manipulation to replace bank account numbers and modules to exfiltrate saved Firefox passwords; sinkhole telemetry shows roughly 5,000 unique IPs contacting the C2 daily. The report includes technical details on unpacking, network behavior, DGA logic, and a sample SHA256 for detection.