extra
follower
run
scub
Behavioral task
behavioral1
Sample
UpdaterTag.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
UpdaterTag.dll
Resource
win10v2004-20250314-en
Target
UpdaterTag.dll
Size
61KB
MD5
be06d0b1863afe4ef8228734497bf070
SHA1
01bc9765d91506de98fdc7100a8cbf29a00c42bf
SHA256
6efecfde145da3e885b576c5ad101ef2bbfc992b1daaf639d6466e0f34a291ca
SHA512
11e537ca7833128fe0019b7c6c2422e5ec129969cdd7b537addef8fc032d91507ad664b3fa5dcaa685f6dde28dc6aa3391e3d6e8ee207662ecbd6b5276f44da4
SSDEEP
768:mzsvRTYSfv3nabO35TxhKaS8TAu0X8w4jU2zRobK3Jj6abTFUK8CCLicljcTqgu:mzcnnoORm8Jh1RoGZO0ADicVPg
latrodectus
1.4
https://forefilarem.com/test/
https://xiolewarentiom.com/test/
Detects Latrodectus v1.4.
resource | yara_rule |
---|---|
sample | family_latrodectus_1_4 |
Checks for missing Authenticode signature.
resource |
---|
UpdaterTag.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PeekNamedPipe
GetLastError
CreateMutexW
MessageBeep
MessageBoxA
extra
follower
run
scub
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ