BeepRAT: Lua FFI/TCC In-Memory Shellcode Execution from User-Writable Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•9

Detects in-memory shellcode execution chains associated with BeepRAT and DcRAT. This includes the use of TCC (Tiny C Compiler) with specific flags for in-memory execution and LuaJIT FFI calls used to invoke Windows kernel functions (VirtualAlloc/CreateThread) for shellcode injection.