extra
follower
run
scub
Behavioral task
behavioral1
Sample
UpdaterTag.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
UpdaterTag.dll
Resource
win10v2004-20250129-en
Target
UpdaterTag.dll
Size
72KB
MD5
bcdf04fb5b921b898389482400e39187
SHA1
f5284c8a66b7b5202547515fe34c3c5294620dd5
SHA256
6ca8800c6d3cd512e7ae72e1262408f7e00c1df0e50fd468b63d09c52835824e
SHA512
0b2100b57bb438c9aecdcb27f345614e89ba13a8271474b834af67afae6b316c4df93ad55ecf4b44b96e1c08a45ad6609313b84ef75af6530843a1ca7574c758
SSDEEP
1536:Tzh7eO6hHRCWqBfml4I6z5If8IM4Ny9KW:Tzh7WZIWWfmlAIkIM4YKW
latrodectus
1.4
https://vivaforevew.com/test/
https://wersogkiwgow.com/test/
Omega
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Detects Latrodectus v1.4.
resource | yara_rule |
---|---|
sample | family_latrodectus_1_4 |
Checks for missing Authenticode signature.
resource |
---|
UpdaterTag.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PeekNamedPipe
GetLastError
CreateMutexW
MessageBeep
MessageBoxA
extra
follower
run
scub
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ