RatHat exfiltration to C2 credential/ADB/cipher API endpoints
Detects HTTP POST requests from Android devices identified as RatHat malware, specifically targeting exfiltration of sensitive data including credentials, cipher keys, and ADB certificate/key uploads via the malware's C2 API.
Suricata
