RatHat C2 Evasion List Fetch via /api/sapp or /api/bapp Endpoints

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

This rule detects network traffic patterns associated with the RatHat Android malware. Specifically, it monitors for HTTP requests targeting the '/api/sapp' or '/api/bapp' URIs, which are used by this malware for C2 evasion or to retrieve its block list.