Full report is available at https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/ The exposed server at 198[.]245[.]53[.]26 gave a rare opportunity to compare two related Banana RAT branches through live infrastructure, sandbox telemetry, and recovered payloads. The older branch used ETW-themed paths, static Microsoft-looking names,...