extra
follower
run
scub
Behavioral task
behavioral1
Sample
719e19ead52a80b15bf887f3b9a6ab6d50c15d026766db41302c5e4b12949295.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral2
Sample
719e19ead52a80b15bf887f3b9a6ab6d50c15d026766db41302c5e4b12949295.dll
Resource
win11-20241007-en
Target
719e19ead52a80b15bf887f3b9a6ab6d50c15d026766db41302c5e4b12949295.dll
Size
72KB
MD5
cff9d6bc7a7fa11284f260cd7c46d974
SHA1
6af33a6c0258b4c72d566a67fa033e2e0b61513e
SHA256
719e19ead52a80b15bf887f3b9a6ab6d50c15d026766db41302c5e4b12949295
SHA512
e429d0712be34312da98d23bdbb848f92a226e9151b9a8b70608da844e192fdc4285982668d18aab6955b3ce0a8e0647348c32a553b3d65188f959cbbb1b364c
SSDEEP
1536:czhhNZ0O/Zs2M+RBHA8X6jK4meixMRdgf8QQhIJoT1s:czhhPJZM+08X6jKZZMjgkQQhIAi
latrodectus
1.4
https://piloferstaf.com/test/
https://ypredoninen.com/test/
Sigma
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Detects Latrodectus v1.4.
resource | yara_rule |
---|---|
sample | family_latrodectus_1_4 |
Checks for missing Authenticode signature.
resource |
---|
719e19ead52a80b15bf887f3b9a6ab6d50c15d026766db41302c5e4b12949295.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PeekNamedPipe
GetLastError
CreateMutexW
MessageBeep
MessageBoxA
extra
follower
run
scub
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ