RatHat FRP Tunnel Configuration Retrieval from C2

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects network traffic containing configuration parameters associated with RatHat Android malware (FrpsAddr, FrpsPort, FrpsToken), indicating an attempt to establish a reverse tunnel to a Command and Control server for remote access or proxying.