BeepRAT Lua FFI Shellcode Loader via LuaJit.exe Loading temp.bin

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the execution of LuaJit.exe with a config.ini script, which acts as a Lua-based shellcode loader for BeepRAT. The loader uses Lua FFI to call Windows APIs such as VirtualAlloc and CreateThread to execute shellcode stored in temp.bin directly in memory. This pattern is indicative of fileless execution techniques employed by the BeepRAT remote access trojan.