{
  "family": "erazer_lite",
  "sample_count": 1500,
  "category": "trojan",
  "description": "Erazer Lite (tracked as Trojan:Win32/ErazerLite and Backdoor.Erazer.Lite) is a streamlined, optimized variant of the parent Erazer remote access trojan codebase. Engineered with a reduced binary footprint, Erazer Lite omits the heavier GUI-based management features of the original framework in favor of rapid deployment, stealthy persistence, and covert background execution. It focuses heavily on credential theft, keystroke logging, and remote backdoor access via lightweight TCP reverse connections. Erazer Lite spreads via malicious email attachments, peer-to-peer networks, and bundled installers. Once deployed onto a target Windows host, the malware establishes persistence through user Run keys, injects execution threads into host processes, and beacons to attacker-controlled infrastructure while actively evading legacy file scanners.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Erazer Lite Trojan",
    "Win32/ErazerLite",
    "Backdoor.Win32.ErazerLite",
    "Trojan:Win32/Erazer.B"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Erazer Lite and how does it differ from full Erazer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Erazer Lite is a compact, streamlined variant of the Erazer RAT focusing on low-footprint covert access and credential harvesting."
      }
    },
    {
      "@type": "Question",
      "name": "How does Erazer Lite infect target Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It infects systems through malicious email lures, peer-to-peer file downloads, and bundled software installers."
      }
    },
    {
      "@type": "Question",
      "name": "What are the core capabilities of Erazer Lite?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Its capabilities include keystroke logging, clipboard harvesting, command shell execution, and file exfiltration."
      }
    },
    {
      "@type": "Question",
      "name": "What persistence mechanisms does Erazer Lite establish?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Erazer Lite adds registry autostart Run entries and creates hidden shortcuts within the user's Startup folder."
      }
    },
    {
      "@type": "Question",
      "name": "How can security administrators detect and eliminate Erazer Lite?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Organizations can eliminate Erazer Lite using modern EDR behavioral monitoring, full-disk antimalware scans, and registry hygiene audits."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056",
    "T1059",
    "T1106",
    "T1112",
    "T1071"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056",
      "name": "Input Capture",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071",
      "name": "Application Layer Protocol",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Erazer Lite binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Erazer Lite installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.ErazerLite",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/erazerlite"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/ErazerLite",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/ErazerLite"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2004,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "erazer"
    ],
    "variants": [
      "ErazerLite.Build104"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568"
  ],
  "iocs": {
    "file_hashes": [
      "1b84920c7a5f6e8d91a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4",
      "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6"
    ],
    "delivery": [
      "Compromised utility downloads and bundled freeware applications",
      "Secondary dropper execution via malicious script lures"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ErazerLiteAgent",
      "Startup directory link placement in %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}