JanelaRAT C2 HTTP Beacon Parameters
Detects HTTP requests containing the VS/PL/AN parameter combination used by JanelaRAT for C2 beaconing. The beacon reports malware version (VS), profile level (PL), and presence of banking security software (AN). JanelaRAT targets Latin American financial institutions (Brazil, Mexico). Note: C2 uses port 443 WITHOUT TLS encryption.
CQL
