BeepRAT DcRAT Keylogger - Low-Level Keyboard Hook from HFY.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects indicators of the BeepRAT malware (associated with Operation DragonClone), including specific process execution patterns of HFY.exe, LuaJit.exe, or tcc.exe, network connections to known C2 infrastructure on port 18848, keylogger file creation, and malicious task scheduling or TCC loader execution techniques.