Microsoft's Project Ire catches evasive LOTUSLITE malware variant undetected by major EDRs

Microsoft Research's Project Ire—an autonomous malware-classification agent powered by large language models—has identified a previously undetected variant of LOTUSLITE, a Windows DLL backdoor. The sample evaded signature-based detection from major endpoint detection and response (EDR) vendors including CrowdStrike Falcon, SentinelOne, Sophos, Trellix, Palo Alto, and ESET as of early June.

How it was discovered#

The malware sample (SHA-256: 47e51e82229e80a387c3cb100d39d3705e6360bbf9bfa1601dbc484e8d02e653) shares tactical behaviors with the LOTUSLITE family documented by Acronis, but its hash didn't appear in published indicators of compromise (IOCs). When submitted to VirusTotal on May 28, only 1 of 72 vendors flagged it as malicious. Within a week, detection improved to 7 of 70 vendors, though the major EDRs still missed it.

What Project Ire revealed#

Project Ire produced a detailed function-by-function behavioral analysis without any human prompting, identifying:

• A loader/DLL split installation routine
• Custom binary protocol C2 communication with magic DWORD identifiers
• Interactive shell functionality via named pipes
• Directory enumeration and file primitives
• Chunked file uploads
• Windows registry-based persistence (HKCU)
• Obfuscated traffic camouflaged as Google and Microsoft services

The sample itself exports a suspicious list of banking-themed function names—Query_Bank, BankofChina, qrBankInit—that appear to mask the actual malware entry point through a hijacked banking/QR SDK shell.

Notably, the binary contained an unobfuscated string naming the threat actor: "BelievemeIamMustang-Panda," aligning with Acronis's assessment (at moderate confidence) that the malware family is attributable to the Mustang Panda threat group.

The significance of behavioral analysis#

Project Ire's approach differs fundamentally from signature matching. Variants that share behavioral tactics and procedures (TTPs) but differ in indicators of compromise can slip past signature-based defenses. By reverse-engineering the binary statically and reconstructing its functionality, Project Ire builds an auditable chain of evidence to determine malicious intent—even when the malware is novel.