MovieReaper HTTP C2 Fake Cloud UI Asset Path Shellcode Download

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects network communications associated with the MovieReaper C2 framework. The rule identifies HTTP requests to specific fake cloud UI assets, connections to the domain 'deadhub.org', and fallback communication attempts to a known hardcoded IP address (193.23.118.155).