Koktevrat Android RAT periodic C2 beacon (AlarmManager-scheduled heartbeat)

Arnold Chan@slaz

•updated 22 days ago•0•0•2

This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.