BeepRAT HWID Fingerprint via HFY.exe Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the presence and execution of 'HFY.exe', a trojanized telecom utility associated with BeepRAT malware. The rule flags file creation or process execution events involving this specific filename, which often indicates the reconnaissance phase where the malware generates a hardware identifier (HWID) for C2 registration.