extra
follower
run
scub
Behavioral task
behavioral1
Sample
UpdaterTag.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
UpdaterTag.dll
Resource
win10v2004-20250314-en
Target
UpdaterTag.dll
Size
61KB
MD5
be06d0b1863afe4ef8228734497bf070
SHA1
01bc9765d91506de98fdc7100a8cbf29a00c42bf
SHA256
6efecfde145da3e885b576c5ad101ef2bbfc992b1daaf639d6466e0f34a291ca
SHA512
11e537ca7833128fe0019b7c6c2422e5ec129969cdd7b537addef8fc032d91507ad664b3fa5dcaa685f6dde28dc6aa3391e3d6e8ee207662ecbd6b5276f44da4
SSDEEP
768:mzsvRTYSfv3nabO35TxhKaS8TAu0X8w4jU2zRobK3Jj6abTFUK8CCLicljcTqgu:mzcnnoORm8Jh1RoGZO0ADicVPg
latrodectus
1.4
https://forefilarem.com/test/
https://xiolewarentiom.com/test/
Detects Latrodectus v1.4.
resource | yara_rule |
---|---|
sample | family_latrodectus_1_4 |
Checks for missing Authenticode signature.
resource |
---|
UpdaterTag.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PeekNamedPipe
GetLastError
CreateMutexW
MessageBeep
MessageBoxA
extra
follower
run
scub
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.