RatHat FRP Reverse Tunnel C2 Registration from Android Device
Detects the handshake process of the frpc (Fast Reverse Proxy Client), which is associated with the RatHat malware family, attempting to register a reverse tunnel for command and control purposes.
Suricata
