latrodectus | 18723427693[.]zip

General

Target
18723427693.zip
Size 32KB
Sample240827-rywxmavgre
SHA256 02823fa1cb13dfdacbe0041b4418548709dc520f22236251a68b4a5a1e0351af
MD5 15945f784790116923eeb93cd067126d
SHA1 9b2c2865be7c64b9fe64c57b19725e5b71426e81
SHA512 d81d4be991d8c271aa84c61f33e9b216bf4132574ced6d67503f26ab966612017b4e0814297dfa2bff1103ece94bd02c1ba3fd97cad8fe5b4cce8edc466c1d4f
SSDEEP 768:loPtvihu66qcnIU4kjCPIx4gMiOyW7SdONY:lolvyT6H4k/YyQSdOy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

latrodectus

Malware Config

Signatures

Detects Latrodectus 1 IoCs

Detects Latrodectus v1.4.

resource	yara_rule
static1/unpack001/5decad758ad23f90ceafd132702935d4feb17a77859bbd2d6573f00e1d3180f1	family_latrodectus_1_4

Latrodectus family
latrodectus

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5decad758ad23f90ceafd132702935d4feb17a77859bbd2d6573f00e1d3180f1

File Explorer

18723427693.zip

.zip 32KB
5decad758ad23f90ceafd132702935d4feb17a77859bbd2d6573f00e1d3180f1

.dll 72KB

18723427693.zip

SHA256 02823fa1cb13dfdacbe0041b4418548709dc520f22236251a68b4a5a1e0351af
MD5 15945f784790116923eeb93cd067126d
SHA1 9b2c2865be7c64b9fe64c57b19725e5b71426e81
SHA512 d81d4be991d8c271aa84c61f33e9b216bf4132574ced6d67503f26ab966612017b4e0814297dfa2bff1103ece94bd02c1ba3fd97cad8fe5b4cce8edc466c1d4f
SSDEEP 768:loPtvihu66qcnIU4kjCPIx4gMiOyW7SdONY:lolvyT6H4k/YyQSdOy
MD5 SHA1 SHA512 SSDEEP

Password

infected

5decad758ad23f90ceafd132702935d4feb17a77859bbd2d6573f00e1d3180f1

IMPHASH db7aeb75528663639689f852fd366243
SHA256 5decad758ad23f90ceafd132702935d4feb17a77859bbd2d6573f00e1d3180f1
MD5 ef37aa053b8b86c089bfb95871511820
SHA1 84b530565a0d6d84a96bd2a8ec89174dff77311d
SHA512 658350af7c46eae8bbfbf0aa4d78580a0efb7e908ef9c5a200c9d3cacc8a51c03930407bb5a1da86fc1ab58ca8bc4fd729a650ded220ce188c456b57cff82c5c
SSDEEP 1536:ozhHuRqOoGc2WsV/bWM5wpokf8m1eTWfk:ozhHuRooWM5wBkmHf
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects Latrodectus

Detects Latrodectus v1.4.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

6

Entry point

18956

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

18723427693.zip

5decad758ad23f90ceafd132702935d4feb17a77859bbd2d6573f00e1d3180f1

kernel32

user32

generic

Sharing

General

Malware Config

Signatures

File Explorer

18723427693.zip

5decad758ad23f90ceafd132702935d4feb17a77859bbd2d6573f00e1d3180f1

kernel32

user32

generic