Microsoft's Project Ire catches LOTUSLITE variant that evades 6 major EDRs

Microsoft's Project Ire, an LLM-driven autonomous malware-classification agent, successfully identified a novel variant of the LOTUSLITE Windows DLL backdoor that most major EDR solutions still miss. The sample (SHA-256: 47e51e82229e80a387c3cb100d39d3705e6360bbf9bfa1601dbc484e8d02e653) was not in Acronis's IOC list and, as of June 4, evaded detection by CrowdStrike Falcon, SentinelOne, Sophos, Trellix, Palo Alto, and ESET. Ire analyzed the binary solely with its decompiler-based tools, producing a function-by-function behavioral report covering the install routine, C2 packet layout, command IDs, persistence mechanism, and obfuscation—matching Acronis's manual analysis. The agent operated without any context (no origin metadata, telemetry, or analyst prompts) and reached a 'malicious' verdict.

This case highlights the power of behavioral, agentic reverse engineering when signature matching falls short. Variants that share TTPs but not IOCs are caught instead of slipping past signature lists. Notably, Ire correctly handled a misleading function name (nfapi::nf_unRegisterDriver) that could have led to false attribution of active packet interception; it flagged the name as suspicious but did not claim the behavior, focusing on actual code actions. This demonstrates the nuance LLM-driven analysis can achieve. Project Ire's ability to produce an auditable chain of evidence without human priors represents a leap forward in malware classification, especially for novel threats where no automatic validator exists.