BeepRAT TCC/LuaJit Shellcode Loader Correlated with C2 Beacon on Port 18848

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of specific suspicious binaries (tcc.exe or LuaJit.exe) with command-line arguments indicative of shellcode loading, followed by a network connection to known C2 infrastructure (IP 207.56.8.166 or Port 18848) from the same host within 15 minutes.