pyCodeVx RAT beacon: base64 victim ID + ddnsfree C2 traffic

Renata Cardoso@rcardososec

•updated Aug 26, 2026•2•0•3

Detects outbound HTTP traffic indicative of pyCodeVx RAT check-in behavior. The rule identifies communication with ddnsfree.com C2 domains or requests containing the 'pyCodeVx' marker in the URL or User-Agent, coupled with a base64-encoded, fixed-format victim/session ID.