Lightlife RAT ZIP Archive Creation and HTTP POST Exfiltration to C2

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects the use of PowerShell to archive files (using Compress-Archive) followed by an HTTP network connection to a suspicious external IP address (91.196.32.232) within a short time window. This sequence is often indicative of data staging followed by exfiltration.