Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to malware
MalwareUsed by 1 actor

LuaJIT trojan

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial
THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
TroyDen

The campaign deploys a custom LuaJIT trojan carefully designed to slip past automated security tools. Each malicious ZIP package contains three items: a batch file called Launch.bat, a renamed LuaJIT runtime named unc.exe, and an obfuscated Lua script hidden as license.txt.

via cyber security newscybersecuritynews.com
MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique
T1204.002Malicious FileEvidence1

Each malicious ZIP package contains three items: a batch file called Launch.bat, a renamed LuaJIT runtime named unc.exe, and an obfuscated Lua script hidden as license.txt.

Persistence

1 technique
T1112Modify RegistryEvidence1

Four registry writes disable Windows proxy auto-detection, pushing outbound traffic past corporate inspection layers.

Stealth

6 techniques
T1027Obfuscated Files or InformationEvidence1

The most technically distinctive part of this campaign is the way its payload is split to avoid detection... a renamed LuaJIT runtime named unc.exe, and an obfuscated Lua script hidden as license.txt. When either file is submitted to an automated scanner on its own, it appears harmless.

T1036MasqueradingEvidence1

The attack centers on a convincingly built GitHub repository — AAAbiola/openclaw-docker — that impersonates a Docker deployment tool for the legitimate OpenClaw AI project. The repository features a polished README with installation instructions for both Windows and Linux, a companion GitHub.io page, and real contributors.

T1497Virtualization/Sandbox EvasionEvidence1

Once both pieces are armed, the payload runs through five anti-analysis checks — scanning for debugger presence, low RAM, short system uptime, elevated privilege access, and specific computer names. If anything looks like a sandbox, execution stops.

T1497.001System ChecksEvidence1

Once both pieces are armed, the payload runs through five anti-analysis checks — scanning for debugger presence, low RAM, short system uptime, elevated privilege access, and specific computer names.

T1497.003Time Based ChecksEvidence1

If not, a Sleep() call kicks in for roughly 29,000 years, long enough to outlast any timed analysis window.

T1622Debugger EvasionEvidence1

Once both pieces are armed, the payload runs through five anti-analysis checks — scanning for debugger presence... If anything looks like a sandbox, execution stops.

Defense Impairment

1 technique
T1112Modify RegistryEvidence1

Four registry writes disable Windows proxy auto-detection, pushing outbound traffic past corporate inspection layers.

Discovery

4 techniques
T1497Virtualization/Sandbox EvasionEvidence1

Once both pieces are armed, the payload runs through five anti-analysis checks — scanning for debugger presence, low RAM, short system uptime, elevated privilege access, and specific computer names. If anything looks like a sandbox, execution stops.

T1497.001System ChecksEvidence1

Once both pieces are armed, the payload runs through five anti-analysis checks — scanning for debugger presence, low RAM, short system uptime, elevated privilege access, and specific computer names.

T1497.003Time Based ChecksEvidence1

If not, a Sleep() call kicks in for roughly 29,000 years, long enough to outlast any timed analysis window.

T1622Debugger EvasionEvidence1

Once both pieces are armed, the payload runs through five anti-analysis checks — scanning for debugger presence... If anything looks like a sandbox, execution stops.

Collection

1 technique
T1113Screen CaptureEvidence1

Every victim machine is geolocated the moment execution begins, and a full desktop screenshot is captured and sent to a C2 server in Frankfurt, Germany.

Command and Control

1 technique
T1105Ingress Tool TransferEvidence1

The payload then captures the full desktop and uploads it via a hardcoded multipart POST to the Frankfurt C2 server, which responds with encrypted task and loader blobs saved to the victim’s Documents folder.

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence1

The payload then captures the full desktop and uploads it via a hardcoded multipart POST to the Frankfurt C2 server, which responds with encrypted task and loader blobs saved to the victim’s Documents folder.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
Start free trial
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.