latrodectus | 22f06d9fc9d95f0945fc6113c091a072[.]bin

General

Target
22f06d9fc9d95f0945fc6113c091a072.bin
Size 24KB
Sample240505-bdkqvshe3v
SHA256 5bdbaddfb5463aa7bcaf509262bdfadb5fceb803a2102d5abafb4db48359f2ae
MD5 4ac9a7ffa74a53f3c3f3abe2446cb303
SHA1 bd50fbea1f508f689a8e1c1c57b190a867de592c
SHA512 d97373ab7a03f340afa503ca1babce2d320d648d5994a2ee0f8b8f0a5437f2b0bdead2dc84b915e41afa6281af2004650fc09533314d78cfe7380d2cf26d5b10
SSDEEP 768:zz4Psvnj1mULX3/9RZ6pQeoMgCPiBolpeM:vHvnhJ6nXKolMM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loader latrodectus

Malware Config

Extracted

Family

latrodectus

C2

https://winarkamaps.com/live/
https://stratimasesstr.com/live/

Signatures

Detect larodectus Loader variant 2 1 IoCs

loader

resource	yara_rule
static1/unpack001/465f931e8a44b7f8dff8435255240b88f88f11e23bc73741b21c20be8673b6b7.exe	family_latrodectus_v2

Latrodectus family
latrodectus

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/465f931e8a44b7f8dff8435255240b88f88f11e23bc73741b21c20be8673b6b7.exe

File Explorer

22f06d9fc9d95f0945fc6113c091a072.bin

.zip 24KB
465f931e8a44b7f8dff8435255240b88f88f11e23bc73741b21c20be8673b6b7.exe

.dll 60KB

22f06d9fc9d95f0945fc6113c091a072.bin

SHA256 5bdbaddfb5463aa7bcaf509262bdfadb5fceb803a2102d5abafb4db48359f2ae
MD5 4ac9a7ffa74a53f3c3f3abe2446cb303
SHA1 bd50fbea1f508f689a8e1c1c57b190a867de592c
SHA512 d97373ab7a03f340afa503ca1babce2d320d648d5994a2ee0f8b8f0a5437f2b0bdead2dc84b915e41afa6281af2004650fc09533314d78cfe7380d2cf26d5b10
SSDEEP 768:zz4Psvnj1mULX3/9RZ6pQeoMgCPiBolpeM:vHvnhJ6nXKolMM
MD5 SHA1 SHA512 SSDEEP

Password

infected

465f931e8a44b7f8dff8435255240b88f88f11e23bc73741b21c20be8673b6b7.exe

IMPHASH db7aeb75528663639689f852fd366243
SHA256 465f931e8a44b7f8dff8435255240b88f88f11e23bc73741b21c20be8673b6b7
MD5 22f06d9fc9d95f0945fc6113c091a072
SHA1 672a5de375d84ac54ff1fc14ec65402c0abeca97
SHA512 7126f2b549a1e746eab78e4b9b111d861b6b27d7ef07b4b73197e21b7544acc18597bc18579a5dc0a1b85e5c7e0bc69090601de6a2cb0b89a2c5fa64bcd2f09a
SSDEEP 768:f0Io0O99dyyus8GgrFuNtxv4c/HFGKndcHrqzwzvCoQ5w7t:caO9qyV8Kv4c/HFGLlzKoQi
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detect larodectus Loader variant 2

loader
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

6

Entry point

15484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

22f06d9fc9d95f0945fc6113c091a072.bin

465f931e8a44b7f8dff8435255240b88f88f11e23bc73741b21c20be8673b6b7.exe

kernel32

user32

generic

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

22f06d9fc9d95f0945fc6113c091a072.bin

465f931e8a44b7f8dff8435255240b88f88f11e23bc73741b21c20be8673b6b7.exe

kernel32

user32

generic