Overview

overview

10

Static

static

1

medk.msi

windows7-x64

10

medk.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    medk.msi

  • Size

    2.0MB

  • Sample

    241113-vvtvmswdnb

  • MD5

    8cb04bf931a19fa0ae1bd7235180dd4a

  • SHA1

    dfc980a827dbde294ae9fa6e63545d1d57344e96

  • SHA256

    dfff1a07429ff9585f3dab9c78b501174e7c326e1fb95c5234368071b5426768

  • SHA512

    58f1661d689aaa9391f04e086db490693f83b70e068ca10b20cff6f87979a8804aa9f054ac961af06c4b7b17fd88b1912774b2eb3d16b9df8e7a4ed9bb3c0a29

  • SSDEEP

    49152:F943YhW8zBQSc0ZnSKBZKumZr7Apj3Y+7jHplNa:6YY0Zn3K/Al3dXHpra

Score
10/10
latrodectusdiscoveryloaderpersistenceprivilege_escalation

Malware Config

Extracted

Family

latrodectus

C2

https://rolefenik.com/test/

https://ergiholim.com/test/

Targets

    • Target

      medk.msi

    • Size

      2.0MB

    • MD5

      8cb04bf931a19fa0ae1bd7235180dd4a

    • SHA1

      dfc980a827dbde294ae9fa6e63545d1d57344e96

    • SHA256

      dfff1a07429ff9585f3dab9c78b501174e7c326e1fb95c5234368071b5426768

    • SHA512

      58f1661d689aaa9391f04e086db490693f83b70e068ca10b20cff6f87979a8804aa9f054ac961af06c4b7b17fd88b1912774b2eb3d16b9df8e7a4ed9bb3c0a29

    • SSDEEP

      49152:F943YhW8zBQSc0ZnSKBZKumZr7Apj3Y+7jHplNa:6YY0Zn3K/Al3dXHpra

    Score
    10/10
    latrodectusdiscoveryloaderpersistenceprivilege_escalation

    • Detects Latrodectus

      Detects Latrodectus v1.4.

    • Latrodectus family

      latrodectus

    • Latrodectus loader

      Latrodectus is a loader written in C++.

      loaderlatrodectus

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks