BeepRAT Screen Capture File Creation from Trojanized Telecom Utility

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation of image files (e.g., .bmp, .png, .jpg) in temporary or specific working directories by processes associated with BeepRAT (HFY.exe, tcc.exe, LuaJit.exe). This activity is indicative of the RAT executing screen capture commands to exfiltrate desktop imagery.