extra
follower
run
scub
Behavioral task
behavioral1
Sample
UpdaterTag.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
UpdaterTag.dll
Resource
win10v2004-20250314-en
Target
UpdaterTag.dll
Size
61KB
MD5
3aaffc6623272985537cafa0b1dd916c
SHA1
1dfda3f5df9325b74526c41856bbbe9376e3ab60
SHA256
ce416c717c07d37c6cfede5310fb340d993c83d27fbed892f14b60f7fa559152
SHA512
54c32d0f4e017ff97ba44f177dbe1bda57460479e040bc95e41056971572371a0c971619ab420e9e2d1c4d85c416deb17aa4a138f9aba8f3f50f40c384e3f47c
SSDEEP
768:+zsvRTYSfv3nabO35TxhKaW8T5ucXlw4/EGzRobK3Jj6abTFUmxgQTVmFB8u:+zcnnoORi8jhZRoGZOU79VmP8
latrodectus
1.4
https://forefilarem.com/test/
https://grazafnulp.com/test/
Detects Latrodectus v1.4.
resource | yara_rule |
---|---|
sample | family_latrodectus_1_4 |
Checks for missing Authenticode signature.
resource |
---|
UpdaterTag.dll |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PeekNamedPipe
GetLastError
CreateMutexW
MessageBeep
MessageBoxA
extra
follower
run
scub
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ