extra
follower
run
scub
Behavioral task
behavioral1
Sample
UpdaterTag.dll
Resource
win10v2004-20250207-en
Behavioral task
behavioral2
Sample
UpdaterTag.dll
Resource
win11-20250207-en
Target
UpdaterTag.dll
Size
72KB
MD5
baff48ded319cdc1eb2372e16c833260
SHA1
6ffbbee909e8225337a61da43f18d48bd403b32d
SHA256
16bf1c6d22074a7532c158c0f8ffd7f1e1c36deab934ea5abad5c0d2cea11a62
SHA512
ce560c27b4403ba9e9b14a7398e469e6fc42f79b70586266ae2d2b2210a9f81ea88e92a6f50b077e8480bc5fa9117d64acf1a6b3b3530807bd1534e5aac2cce6
SSDEEP
768:Tz7vRTYS4Oi5ONdWJ7HRCRuVnxsaQu7SDqRefml4I4QDqauXj57CHf8IdAtY5h82:Tzh7eO6hHRCSsBfml4I6z5If8I6oVTt
latrodectus
1.4
https://apworsindos.com/test/
https://reminasolirol.com/test/
Mimikast
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Detects Latrodectus v1.4.
resource | yara_rule |
---|---|
sample | family_latrodectus_1_4 |
Checks for missing Authenticode signature.
resource |
---|
UpdaterTag.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PeekNamedPipe
GetLastError
CreateMutexW
MessageBeep
MessageBoxA
extra
follower
run
scub
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ