SloppyRAT C2 Beacon HTTP Traffic

Ankit Mehta@Secvyn

•updated Sep 11, 2026•1•0•3

Detects network traffic associated with SloppyRAT C2 beacons by identifying specific user-agent strings ('CommandExecutor/1.0', 'Mozilla/5.0 (compatible; DLLMemLoader/1.0)') or anomalous API path requests containing 'X-API-Key' or 'Authorization: Bearer' headers.