SectopRAT/ArechClient2 AES-encrypted C2 check-in (length-prefixed protocol)

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•2

Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.