BeepRAT Screen Capture via GDI BitBlt and Desktop Bitmap APIs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the execution of the process HFY.exe combined with command-line arguments indicative of screen capture, thumbnail generation, or webcam access. This behavior is consistent with reconnaissance or information gathering activities.