SectopRAT/ArechClient2 IOC sweep: hashes, C2 IP, domains, URL

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•1

This rule detects potential malicious activity by matching file hashes against a known list of malicious indicators and monitoring for suspicious network connections. The network monitoring includes connections to hardcoded malicious IP addresses, specific C2 URLs, and DNS queries for known fallback domains used in malicious infrastructure when the initiating process is not a recognized web browser or wallet application.