BeepRAT TCC/LuaJIT Shellcode Loader via temp.bin and VirtualAlloc

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects execution of potential BeepRAT shellcode loaders (tcc.exe or LuaJit.exe) using specific command-line arguments, as well as the creation of associated files (temp.bin, config.ini.c) or execution patterns initiated by HFY.exe.