HEAVYGRAM/CHOSEN BRICK Malware C2 via Telegram Bot API - Python requests client

Arnold Chan@slaz

•updated 24 days ago•0•0•2

Detects outbound network traffic to the Telegram Bot API characteristic of malware command and control (C2). This rule specifically identifies Python-based requests using the 'python-requests' user agent performing common Telegram API operations (getUpdates, sendDocument, sendPhoto, getFile) typical of C2 frameworks like HEAVYGRAM or CHOSEN BRICK.