Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud In this blog entry, researchers from the TrendAI™ MDR team discuss how they mapped the full end-to-end operation of SHADOW-WATER-063’s Banana RAT banking malware by analyzing server-side artifacts and victim-side data. Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud | Trend Micro (US) search close About Mission and Culture Mission and Culture As a leader in the AI-driven shift,…

https://www.trendmicro.com/en_us/research/26/e/banana-rat.html

sha256:bd2aaf4bf72bb1f28d6711795b7b9d9946ffa43eb855de4f14170b88ff0b6c71

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve1
md50
url2
ipv42
ipv60
sha10
domain24
sha2564
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	cmd.exe	Open →
domain	powershell.exe	Open →
cve	CVE-2026-33017	Open →
domain	windowsk-cdn.com	Open →
domain	c.windowsk-cdn.com	Open →
sha256	38dfeb772afbd01c04eddda120d283acfb1147a6dc3d54ac62fe23ad06e39d8f	Open →
sha256

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports