PHOTOLITE
- First seen
- 2022-11-01 00:00:00
- Malware type
- loader, botnet
- Profile updated
- 2026-07-07 14:51:00
Targeted industries: financial-services
Context
PHOTOLITE is the lite version of the GZIPLOADER with limited capabilities i.e. for example it does not have any functionality to exfiltrate the host information. This new variant is observed as a follow-on payload in a TA542 Emotet campaign back in November'22. contains a static URL to download a "Bot Pack" file with a static name (botpack.dat) which results in the IcedID Lite DLL Loader, and then delivers the Forked version of IcedID Bot, leaving out the webinjects and backconnect functionality that would typically be used for banking fraud.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Photolite_Auto (yara-rule)
Reports & references
- proofpoint.com — Comprehensive Look Emotets Fall 2022 Return (report)
- intrinsec.com — Emotet Returns And Deploys Loaders (report)
- proofpoint.com — Fork Ice New Era Icedid (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Photolite (report)