BeepRAT C2 Address Retrieval from HKCU\Software\Creeper Registry Key

Ethan Andrews@eandrews

•updated Jun 29, 2026•0•0•2

This rule detects registry interactions involving the HKCU\Software\Creeper registry key, which is associated with BeepRAT. The malware utilizes this registry path to dynamically retrieve or update its command-and-control (C2) server infrastructure, allowing the attacker to change infrastructure without modifying the embedded implant code.