MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 025abbec1724b9180b369fe116da9d90ae47a4996f6a4e28e8a947bac1e0c741. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Latrodectus


Vendor detections: 9


Intelligence 9 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 025abbec1724b9180b369fe116da9d90ae47a4996f6a4e28e8a947bac1e0c741
SHA3-384 hash: e207b56cacc535f57f0671a85f50642242fb1cd6fb69fa2268ed41477f45dd29b03eecce0b40fc3bc7bca23e1571e43d
SHA1 hash: a1f854c29a69c19949499fca5e24b02b97be46fd
MD5 hash: c65899e2519f4ad21fb4b97f0a113362
humanhash: nitrogen-mango-quiet-bulldog
File name:lavi.msi
Download: download sample
Signature Latrodectus
Create hunting rule
File size:2'131'456 bytes
First seen:2024-11-13 09:58:07 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:/c53YhW8zBQSc0ZnSKBZKumZr7Aej3YOXT7wYyr8lCV:QYY0Zn3K/Ai33XXZ0
TLSH T144A5F12233C6C537C9AE01307A1AD66B557DFCA74B3140D7A3C82A2EAE745C06639F97
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter pr0xylife
Tags:BruteRatel Latrodectus msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
US US
Vendor Threat Intelligence
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=673519b834b6906b348291fd
Tags:
shellcode virus html
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug cmd fingerprint keylogger lolbin packed remote wix
Link:
https://www.filescan.io/uploads/67347868da907f44e3003fc0/reports/d4b2968f-ac97-4ef8-aac7-0e20926f3309/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/025abbec1724b9180b369fe116da9d90ae47a4996f6a4e28e8a947bac1e0c741
Result
Threat name:
BruteRatel, Latrodectus
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1555052
Signature
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Sample uses string decryption to hide its real strings
Sets debug register (to hijack the execution of another thread)
Sigma detected: RunDLL32 Spawning Explorer
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Yara detected BruteRatel
Yara detected Latrodectus
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1555052 Sample: lavi.msi Startdate: 13/11/2024 Architecture: WINDOWS Score: 100 37 xomamox.com 2->37 39 rolefenik.com 2->39 51 Suricata IDS alerts for network traffic 2->51 53 Found malware configuration 2->53 55 Antivirus detection for URL or domain 2->55 57 6 other signatures 2->57 8 rundll32.exe 2->8         started        10 msiexec.exe 14 40 2->10         started        14 msiexec.exe 2 2->14         started        signatures3 process4 file5 16 rundll32.exe 12 8->16         started        27 C:\Windows\Installer\MSI2701.tmp, PE32 10->27 dropped 29 C:\Users\user\AppData\Roaming\apptext.dll, PE32+ 10->29 dropped 31 C:\Windows\Installer\MSI25D6.tmp, PE32 10->31 dropped 33 3 other files (none is malicious) 10->33 dropped 59 Drops executables to the windows directory (C:\Windows) and starts them 10->59 20 msiexec.exe 10->20         started        22 MSI2701.tmp 10->22         started        signatures6 process7 dnsIp8 35 xomamox.com 80.66.76.106, 49705, 58081, 58085 VAD-SRL-AS1MD Russian Federation 16->35 43 System process connects to network (likely due to code injection or exploit) 16->43 45 Contains functionality to inject threads in other processes 16->45 47 Injects code into the Windows Explorer (explorer.exe) 16->47 49 5 other signatures 16->49 24 explorer.exe 45 1 16->24 injected signatures9 process10 dnsIp11 41 rolefenik.com 172.67.191.232, 443, 58086, 58087 CLOUDFLARENETUS United States 24->41
Score:
91%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/025abbec1724b9180b369fe116da9d90ae47a4996f6a4e28e8a947bac1e0c741
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/025abbec1724b9180b369fe116da9d90ae47a4996f6a4e28e8a947bac1e0c741/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ajnlx3axes4rqczwt7qrnwu5scxepjezn5ve4khivfd3vqpay5aq._file
Verdict:
malicious
Label(s):
bruteratelc4
Create hunting rule
Similar samples:
error
Latrodectus
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery persistence privilege_escalation
Link:
https://tria.ge/reports/241113-lz275ssqgr/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Enumerates connected drives
Blocklisted process makes network request
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d660798e-5c73-4f43-93d6-5f8542cb3805
Malware family:
Latrodectus
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/025abbec1724/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_LATAM_MSI_Banker
Create hunting rule
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments