Password-protected archives can hide far more than they appear to. In this case, the real trick is not the malware family itself but the delivery format: a small 7-zip file unpacked into an 806 MB executable padded with null bytes, which helps the payload slip past size-based checks and simple archive screening.
The infection chain led from Lumma Stealer to Sectop RAT, also tracked as ArechClient2. The observed activity included rundll32 launching NOA.dll and command-and-control traffic to 91.92.241.102 on ports 9000 and 443, giving defenders concrete hunt points for both the dropped DLL and the network beaconing.
The forward risk is that archive size is no longer a reliable signal for malicious payload volume. Null-byte padding lets operators compress very large executables into deceptively small, password-protected containers, so controls that only inspect archive metadata will miss the real payload.