#ParsedReport #CompletenessMedium
26-09-2026

BotHelper RAT: From Encrypted Payload to Live Screen Surveillance

https://www.pointwild.com/threat-intelligence/bothelper-rat-from-encrypted-payload-to-live-screen-surveillance/

Report completeness: Medium

Threats:
Bothelper

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1027, T1036, T1041, T1053.005, T1059, T1059.001, T1071.001, T1105, T1113, T1115, have more...

IOCs:
File: 9
Domain: 1
Url: 1
IP: 1
Hash: 2

Soft:
Microsoft Edge

Algorithms:
xor

Functions:
Capture, CommandCenter

Win API:
WinHttpReadData, CreateProcessA, MessageBox

Languages:
php, powershell

Platforms:
x64