extra
follower
run
scub
Behavioral task
behavioral1
Sample
UpdaterTag.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
UpdaterTag.dll
Resource
win11-20240802-en
Target
UpdaterTag.dll
Size
60KB
MD5
c6defb73ea6c5ed9c9c9127912173585
SHA1
7094f6e20e574ac665fbd0eabefcdf884d92071e
SHA256
ebc6a85717dbb95d489ceff61305f88476a094509d0ced095aaf730fad35bf3e
SHA512
c32e34fdc47a13324fe8fd44ae74a16b6c4cb03e0ebfa4c1770e48cfc807ce1cc8f9d143f746bb4bd804f985b158c7c228a39fb5e0cdacff12492d041c30d17b
SSDEEP
768:izsvRTYS/m6QFON/LbazVJ/lNSuycf8buR6ExXPYEgUDP+6G8/:izc+jFORXaR2ihxziF
Detects Latrodectus v1.4.
Processes:
resource | yara_rule |
---|---|
sample | family_latrodectus_1_4 |
Checks for missing Authenticode signature.
Processes:
resource |
---|
UpdaterTag.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PeekNamedPipe
GetLastError
CreateMutexW
MessageBeep
MessageBoxA
extra
follower
run
scub
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ