extra
follower
run
scub
Behavioral task
behavioral1
Sample
1984-27-0x000007FFFFF70000-0x000007FFFFF85000-memory.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1984-27-0x000007FFFFF70000-0x000007FFFFF85000-memory.dll
Resource
win10v2004-20241007-en
Target
1984-27-0x000007FFFFF70000-0x000007FFFFF85000-memory.dmp
Size
84KB
MD5
61ec3f781213f4d71054b2f5fa5d4f12
SHA1
ce81159a42882a519c47fc9e2c0949b7c15957fe
SHA256
39d45192fb37e71a82bbf811c4a15de14f2ad6c9cf3c0fcadd70fa98769be93a
SHA512
4c039a12019a247bd4dd235a65c4515d54fef02da7b6c5e3e86ce0ad9d9caaf443261a1f1baf969750a7daef1918929de8047ac250e5981f2ed95a0a3f82400b
SSDEEP
768:uzsvRTYS/m6QFON/LbazVJ10NNuycf8buR6ExXPYEgUDP+JoMe1kKM:uzc+jFORXaKjihxziJot
latrodectus
https://rolefenik.com/test/
https://ergiholim.com/test/
Detects Latrodectus v1.4.
Processes:
resource | yara_rule |
---|---|
sample | family_latrodectus_1_4 |
Checks for missing Authenticode signature.
Processes:
resource |
---|
1984-27-0x000007FFFFF70000-0x000007FFFFF85000-memory.dmp |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PeekNamedPipe
GetLastError
CreateMutexW
MessageBeep
MessageBoxA
extra
follower
run
scub
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ