SectopRAT AES-encrypted credential/wallet JSON exfiltration to hardcoded C2 socket

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•1

Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.