BeepRAT LuaJIT FFI Shellcode Injection via ffi.load kernel32

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects activities associated with the BeepRAT malware, including the execution of LuaJit.exe with specific command-line arguments (config.ini, temp.bin), the creation of staging files in the TCC local AppData directory, and parent-child process relationships involving a known dropper (HFY.exe). It also utilizes specific SHA256 hashes to identify known malicious BeepRAT binaries.