EGABTR is a Trojan horse malware program, sometimes pronounced "Eggbeater," that became notable in the late 1980s and early 1990s. It was disguised as a graphics utility that purported to improve Enhanced Graphics Adapter (EGA) display quality, but its actual behavior was destructive: it deleted the file allocation tables on the hard drive of affected systems. After execution, it displayed a taunting text message; one commonly reported variant was "Arf! Arf! Got you!", although cited sources disagreed on the exact wording. The malware was first isolated in the United States in 1985. Reporting cited in the content states that it was distributed via electronic bulletin boards, including an example in which CBS executive Richard Streeter reportedly downloaded it while searching for software to improve his system. The content places EGABTR among notable malware from the 1980s. No specific threat actor attribution, industry targeting, or additional indicators of compromise beyond the displayed message are provided in the source content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacking in the 1980s ... Malware ... CyberAIDS ... EGABTR ... Elk Cloner
Malware ... EGABTR
Malware ... EGABTR
A fake graphics utility claiming to improve EGA display quality that actually deleted the file allocation tables on the hard drive and displayed the message "Arf! Arf! Got you!".
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.