NF-e Invoice Lures Deliver Banana RAT via Malicious Batch Files

Key Takeaways

• A new banking trojan, dubbed Banana RAT, is actively targeting financial institutions and cryptocurrency exchanges in Brazil.
• The malware is delivered through malicious batch files disguised as legitimate NF-e (electronic invoice) documents, often spread via WhatsApp or phishing.
• Banana RAT employs advanced evasion techniques, including in-memory decryption and polymorphic payloads, making detection challenging for traditional security solutions.
• Once installed, it provides attackers with extensive remote control, enabling screen streaming, keylogging, fake banking overlays, and real-time Pix QR code manipulation.

Sophisticated Banana RAT Campaign Targets Brazilian Financial Sector

A newly identified banking trojan, named Banana RAT, is actively engaged in a sophisticated campaign against Brazilian users, specifically targeting the nation’s financial sector. This potent malware is distributed via deceptive NF-e (Nota Fiscal Eletronica) documents, tricking victims into executing malicious batch files that surreptitiously install a powerful remote access tool on their Windows systems.

The ongoing operation against Brazilian financial institutions exhibits a high degree of organization and resourcefulness, suggesting a well-funded and persistent threat actor.

Exploiting Trust in Brazil’s Electronic Invoicing System

Attackers are leveraging the widespread trust in Brazil’s official electronic invoicing system, NF-e, to deliver their malicious payloads. Lure files, typically named “Consultar_NF-e.bat,” are disseminated through WhatsApp messages and phishing links. The objective is to deceive recipients into believing they are opening a routine tax document, thereby granting the attackers persistent and complete control over their compromised machines.

Researchers from Trend Micro’s Managed Detection and Response (MDR) team uncovered the malware during an investigation into a live Brazilian banking trojan operation. Their efforts led to the recovery of both the attacker’s server-side tools and the client-side malware from infected endpoints, providing a comprehensive view of the entire attack chain. Trend Micro’s report, shared with Cyber Security News (CSN), identifies this threat cluster as “SHADOW-WATER-063.”

The campaign’s impact is significant, as Banana RAT specifically targets 16 prominent Brazilian financial institutions, including Itaú, Bradesco, Santander, Caixa, and Banco do Brasil, alongside several localized cryptocurrency exchanges. This precise targeting of Brazil’s financial ecosystem indicates a highly focused operation, minimizing incidental infections outside the intended victim pool.

NF-e Invoice Lures: An Inside Look at the Attack Chain

Analysts speculate that the operation might operate under a Malware-as-a-Service (MaaS) model, potentially reselling platform access to affiliates. The internal server-side code, written entirely in Brazilian Portuguese and bearing the internal codename “Projeto Banana,” points to a meticulously maintained and actively developed toolset, rather than an isolated, one-off attack.

The infection process initiates when a victim executes the malicious batch file. This action triggers a concealed PowerShell command, which discreetly retrieves a small staging script from an attacker-controlled server. This script then downloads an AES-256 encrypted payload, “msedge.txt.” Crucially, this payload is decrypted entirely in memory, preventing any unencrypted file from being written to the victim’s hard drive. This “fileless” approach significantly complicates detection by conventional security tools.

Upon execution, the payload establishes persistence by registering a hidden scheduled task that launches PowerShell every minute for an extended period, up to 9,999 days. The malware also camouflages its files within directory paths that mimic legitimate Microsoft diagnostic storage, designed to blend seamlessly with trusted system files. Furthermore, the polymorphic build pipeline generates a unique byte-level payload for each victim request, rendering file-hash-based detection largely ineffective against this widespread campaign.

Banana RAT’s Remote Fraud and Surveillance Capabilities

Once active, Banana RAT functions as a comprehensive remote fraud and surveillance platform. It continuously streams the victim’s screen to the operator, logs every keystroke, injects convincing fake banking overlays designed to mimic legitimate security update screens, and can intercept or modify Pix QR codes during live payment transactions. Pix, Brazil’s instant payment system managed by the central bank, is a specific target, with the RAT incorporating a dedicated subsystem tailored for this payment rail.

The malware communicates with its command-and-control (C2) server over port 443 using a custom binary protocol secured with AES-256-CBC encryption. It also utilizes a typosquatting domain designed to impersonate legitimate Microsoft CDN infrastructure, with hardcoded fallback IP addresses ensuring redundancy in case the primary domain is disrupted.

What You Should Do

• Block Identified Indicators of Compromise (IoCs): Implement perimeter blocking for all known network IoCs, including domains and IP addresses associated with the Banana RAT campaign.
• Enable Real-Time Behavioral Monitoring: Ensure endpoint detection and response (EDR) solutions are configured for real-time behavioral monitoring to detect anomalous activity that might indicate a Banana RAT infection.
• Educate Users on Phishing and Social Engineering: Conduct regular training for employees and users to recognize and report suspicious emails, messages (especially via WhatsApp), and unexpected file downloads, particularly those disguised as official documents like NF-e invoices.
• Be Wary of Unexpected Banking Overlays and QR Codes: Advise users to be highly suspicious of any full-screen banking overlays or QR code prompts that appear unexpectedly during active banking sessions. Always verify the legitimacy of such prompts through official channels.
• Implement Strong Email and Messaging Security: Utilize advanced email and messaging security solutions to filter out malicious attachments and links.
• Regularly Back Up Data: Maintain regular, secure backups of all critical data to facilitate recovery in the event of a successful malware attack.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.