Extracted

• • Target

    1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11.exe

  • Size

    885KB

  • MD5

    74143402c40ac2e61e9f040a2d7e2d00

  • SHA1

    4053dc85bb86c47c63f96681d6a62c21cd6342a3

  • SHA256

    1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11

  • SHA512

    4aa55b859f15be8b14c4a0ff6f3971f49b47c1c8c8427f179eb4ab0c76e321441adfd173469facb12aae1e81e25f1328fd621214b42e66f690ba4e9ee1e54cf9

  • SSDEEP

    12288:gfPSAAUHV4fZUv/TrguVTax7hNRu18VA8JFoxMk/wYeDKDMyAmp:qPSAAUHV4fZUvfgmaxpu1F8J6xMYHMBS

  Score

  10^/10

  latrodectusloadermicrosoftpersistencephishing

  • Latrodectus loader

    Latrodectus is a loader written in C++.

    loaderlatrodectus

  • Detect larodectus Loader variant 2

    loader

  • Blocklisted process makes network request

  • Drops file in Drivers directory

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Detected potential entity reuse from brand microsoft.

    phishingmicrosoft

  • Drops file in System32 directory

  behavioral1behavioral2