Agent Lure Stealer / SmartLoader combined lure chain hunt

ills3c Intel&Coffee@Ills3C

•updated yesterday•2•0•3

Detects suspicious chains involving LuaJIT binary execution, dropped dist.lua scripts in temp directories, scheduled task persistence utilizing numbered LuaJIT executables, and specific lure zip file downloads or anomalous script creation in setup directories.