BeepRAT TCC In-Memory Shellcode Execution via config.ini.c

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of tcc.exe with specific command-line arguments '-nostdlib', '-run', and a reference to a 'config.ini.c' file. This pattern is indicative of the execution of potentially malicious scripts or payloads, often seen in the context of TCC (Take Command Console) or similar utilities being used to compile or run code after delivery.