BeepRAT Dropper HFY.exe Execution from Trojanized Telecom Utility ZIP

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the execution of 'HFY.exe', which serves as the dropper for the BeepRAT malware. This dropper is typically distributed within a trojanized archive containing legitimate-looking DLLs, such as 'data.dll' (a disguised SQLite database), 'EPPlus.dll', and 'NPOI.dll'. The rule triggers when 'HFY.exe' is executed outside of standard program installation directories.