Banana RAT Evolves: Comparing Two Recent Branches Through ANY.RUN 

This report analyzes two Banana RAT branches observed from an exposed staging host and ANY.RUN telemetry, contrasting an older ETW-themed branch with static Microsoft-like artifacts and a newer branch that uses randomized installation identifiers, VBS-assisted persistence, and WebSocket C2 via host-derived hashed subdomains (.testewin.com) fronted by Cloudflare; it includes IOCs (SHA256s, domains, IP 149.56.12.51), recovered runtime payloads, and evidence of a FastAPI-based payload generator indicating a polymorphic MaaS capability.