Malware
LOTUSLITE
According to Acronis, LOTUSLITE is a custom C++ backdoor delivered via DLL sideloading, where a simple loader executable is used to load a malicious DLL that acts as the primary implant.
LOTUSLITE is a Windows malware family operated by MUSTANG PANDA.
Background
Acronis describes LOTUSLITE as a bespoke C++ backdoor deployed through DLL sideloading, in which a minimal loader executable pulls in a malicious DLL that serves as the main implant. It persists by altering the filesystem and adding user-run registry entries, and reaches a hard-coded command-and-control server over HTTP(S) using the Windows HTTP APIs together with a custom binary protocol. Its espionage features include enumerating the system and users, opening an interactive command shell with redirected I/O, listing directories, and reading and writing files. The codebase reflects fairly modest development maturity and few evasion measures, favoring quick deployment and reliable operation over advanced stealth.
Source: Malpedia (Fraunhofer FKIE).