tl;dr SmartLoader malware campaign, multi-staged obfuscated Lua payload to evade detection, currently very effective. Interesting malware find.

Some nerd named bleuonbase was looking for some random "Effect-native SDK" (whatever that is), the 2nd indexed URL on Google was a spoopy looking GitHub repo.

He showed it to me. I was bored (I'm very sick), so I poked it with a stick. To make a long story short, this looks like a new malware campaign from SmartLoader

The thing is an obfuscated Lua Loader and it comes packaged with the traditional Lua dependency junk (Lua JIT and DLL). The payload launches from a .cmd which just passes a .txt to the Lua JIT binary. This is all standard stuff for SmartLoader from early and mid 2025.

If you're curious, lookup the SHA256 for the obfuscated Lua script on VirusTotal: c36ce9080f624c14dd4e1d451228293f786168f4de2d35690d2cffb6cccbae87 (Image 1)

You'll see some of the other thing it's trying to masquerade as. This is all very silly shenanigans.

It's currently exfiltrating to some German IP address and inserting fake Cloudflare headers to make it look like it's Cloudflare: 213.176.73.145

Look up that IP address on VirusTotal and you'll see even more silly shenanigans (Image 2)

Oh, and uses Socket3.lua for stuff, I've uploaded that to VirusTotal and Triage. Was not seen on VT before: f2e4088ebf9d98bcc7cccff153a26a786927ae8de570889af160e695b35d1624

A story in two images.