extra
follower
run
scub
Behavioral task
behavioral1
Sample
UpdaterTag.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
UpdaterTag.dll
Resource
win11-20240802-en
Target
UpdaterTag.dll
Size
75KB
MD5
08071c1626889186043493cd17007d1b
SHA1
845f7494136882095f391075b0b0113d86380792
SHA256
eaf0ece0a09bb590077f6e5a7115c38b11d7a8e93e5b2a7608724cd66dc327b5
SHA512
80049aff6af3c6ef4f77017141381c01d15d5e00dcb62d0c3d10251798cbe73fb119b6996d7bddee526a75b06615d58281731581023e5ac42a982e1b9b5d54e4
SSDEEP
1536:KzhEJO+9X+cc8TAGRO73fhRPf82jhuplU:KzhEt9HTAGyk2Yp
Detects Latrodectus v1.4.
resource | yara_rule |
---|---|
sample | family_latrodectus_1_4 |
Checks for missing Authenticode signature.
resource |
---|
UpdaterTag.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PeekNamedPipe
GetLastError
CreateMutexW
MessageBeep
MessageBoxA
extra
follower
run
scub
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ