BotHelper RAT gives attackers live Windows screen access

Cybersecurity researchers have identified a previously undocumented Windows remote access trojan that can continuously stream an infected computer’s display to its operators while supporting command execution, downloads, clipboard monitoring and other remote-control functions.

Point Wild’s Lat61 Threat Intelligence team named the malware BotHelper RAT after the Bot. Helper namespace found in its. NET assembly. Its analysis, published on September 24, traced a multi-stage infection chain beginning with a native 64-bit Windows stager and ending with the remote access tool.

The stager first profiles the compromised machine, collecting the computer name, logged-in user, processor configuration and installed memory. It then connects over HTTPS to attacker-controlled infrastructure and retrieves an encrypted file called payload. bin, with certificate validation disabled before the download.

Researchers found that the downloaded 52,744-byte file arrived without a recognisable Windows executable header, readable strings or an obvious structure. The stager decrypted it in memory using a position-dependent XOR routine, revealing a Windows Portable Executable without requiring separate key material.

The recovered program is written to the user’s temporary directory as msedge_proxy. exe, a filename that mimics a legitimate Microsoft Edge component, and is launched without a visible window. Point Wild said the technique helps disguise the malicious process while limiting obvious signs of activity for the victim.

BotHelper then establishes persistence by copying itself to a hidden location and creating a Windows scheduled task that relaunches the copy every 30 minutes. The malware also uses a mutex to prevent duplicate instances and patches the Windows Antimalware Scan Interface, or AMSI, before preparing its command-and-control client.

Observed command traffic demonstrated the surveillance feature directly. The server instructed the infected client to take a screenshot and then start a screen stream. BotHelper captured the primary display, resized frames, encoded them as JPEG images and uploaded them to a designated server endpoint.

During runtime analysis, researchers observed frames measuring 1,440 by 810 pixels being prepared roughly every 333 milliseconds, corresponding to three frames per second. An encoded frame of about 82 kilobytes was held in memory ready for upload, confirming that the malware could provide operators with a continuing view of activity on the desktop.

The researchers said failed screen frames are ignored rather than stopping the stream, while a timing floor limits capture frequency even when the server requests faster delivery.

The live-stream capability forms only part of the RAT’s command set. Its dispatcher can execute commands through the Windows command shell or PowerShell, download and run additional files, capture individual screenshots, monitor the clipboard, restart or shut down the computer, log off the user and manage the malicious client itself.

BotHelper can also retrieve and load additional DLL plugins at runtime, allowing operators to extend its functionality without replacing the installed binary. Researchers identified commands labelled ClipperStart and ClipperStop for clipboard monitoring, although the observed investigation did not establish that cryptocurrency theft had occurred on a victim system.

The malware communicates with PHP-based endpoints on the same infrastructure used to deliver its payload. On initial contact, it can register a device identifier together with information including the user and machine names, Windows version, privilege level and malware version, before polling for instructions and reporting whether assigned tasks succeeded or failed.

Point Wild’s network capture recorded the infected test machine making a TLS connection associated with the domain easyllms. xyz. The researchers also published SHA-256 hashes for the analysed stager, named WindowsUpdate. exe, and the BotHelper payload masquerading as msedge_proxy. exe, providing defenders with indicators for investigation and blocking.

Independent security analysis published after Point Wild’s disclosure highlighted the same combination of encrypted delivery, in-memory decryption, scheduled-task persistence, AMSI manipulation and process masquerading. Defenders were advised to watch for suspicious scheduled tasks, unexpected execution of msedge_proxy. exe from temporary directories and unusual outbound connections to untrusted infrastructure.