PHOTOLITE is the lite version of the GZIPLOADER with limited capabilities i.e. for example it does not have any functionality to exfiltrate the host information. This new variant is observed as a follow-on payload in a TA542 Emotet campaign back in November'22. contains a static URL to download a "Bot Pack" file with a static name (botpack.dat) which results in the IcedID Lite DLL Loader, and then delivers the Forked version of IcedID Bot, leaving out the webinjects and backconnect functionality that would typically be used for banking fraud.
|2023-03-27 ⋅ Proofpoint ⋅ |
Fork in the Ice: The New Era of IcedID
IcedID PHOTOFORK PHOTOLITE PhotoLoader
|2023-01-09 ⋅ Intrinsec ⋅ |
Emotet returns and deploys loaders
BumbleBee Emotet IcedID PHOTOLITE
|2022-11-16 ⋅ Proofpoint ⋅ |
A Comprehensive Look at Emotet Virus’ Fall 2022 Return
BumbleBee Emotet PHOTOLITE
There is no Yara-Signature yet.