SloppyRAT C2 Authentication Beacon via POST /api/auth

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•4

Detects network activity associated with the SloppyRAT malware, specifically identifying C2 authentication attempts via HTTP POST requests containing specific headers and user-agent strings, as well as TLS connections to known malicious domains and IP addresses.