LotusLite DaDaBar Execution Argument (MustangPanda)

Ethan Andrews@eandrews

•updated Jun 9, 2026•4•0•11

Detects the execution of the LotusLite backdoor by identifying its unique command-line argument '--DaDaBar' in conjunction with known executable names ('SmartPrintScreen.exe') or specific staging directories ('\ProgramData\SmartPrint\'). This rule targets a specific execution pattern of the LotusLite malware.