Koktevrat Android RAT IOC hunt: C2 domains, DGA pattern, known hashes

Arnold Chan@slaz

•updated 22 days ago•1•0•2

This rule monitors for network connections to known command-and-control (C2) domains or DGA-patterned domains (ending in .icu or .cfd), as well as the execution or file creation of files matching known malicious SHA256 hashes.