MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0cfb4dce3fc6f73d908b626db6c546e40022d21429d7af369af4d88c2d3abcfa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Latrodectus


Vendor detections: 12


Intelligence 12 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0cfb4dce3fc6f73d908b626db6c546e40022d21429d7af369af4d88c2d3abcfa
SHA3-384 hash: 5f0cd2b98a181e5e748b065c9fc04359da76bb91c4d611a4ecd04573d61d2783a3b66caa0fd9601a22310f3f520895a0
SHA1 hash: d45a7191779c72ffcb2055492df640a10bb83a0c
MD5 hash: 1c933359b04ae4a76996a5a98d9072c0
humanhash: five-sierra-march-johnny
File name:Callisto.exe
Download: download sample
Signature Latrodectus
Create hunting rule
File size:2'681'856 bytes
First seen:2025-07-31 11:23:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7b1eac2cde7083ec429d2022a9e3112f (1 x Latrodectus)
ssdeep 49152:M2dXHPl4nYptNxbzvRmP3QqmetBKg0A12LrxCn1Ma9jlhgapsYiqvQf0cxXpJ7hr:mazBcppsYiqvQf0cx/hUToTR
TLSH T1D3C58D6BBBA801F9C1AEC038C96A610BDB717058037167EF26E09E591F17AE59F3D341
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
dhash icon 2e2d5d1a1aa41000 (5 x Dridex, 2 x BruteRatel, 2 x Latrodectus)
Reporter Anonymous
Tags:exe Latrodectus

Intelligence

File Origin
# of uploads :
1
# of downloads :
287
Origin country :
GR GR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Callisto.exe
Verdict:
Malicious activity
Analysis date:
2025-07-31 11:25:30 UTC
Tags:
latrodectus
Link:
https://app.any.run/tasks/82c5527e-3fb8-45fb-8743-b00a3a44ef26

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Latrodectus
Create hunting rule
Link:
https://www.capesandbox.com/analysis/18002/
Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=688b526daf3050dc8d32b318
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending a custom TCP request
Verdict:
Suspicious
Labled as:
Generik.MHOJISZ trojan
Link:
https://www.hybrid-analysis.com/sample/0cfb4dce3fc6f73d908b626db6c546e40022d21429d7af369af4d88c2d3abcfa
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/58abca6c-0e9f-4a7b-99fe-6b327e3421af
Score:
79%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0cfb4dce3fc6f73d908b626db6c546e40022d21429d7af369af4d88c2d3abcfa
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) Win 64 Exe x64
Link:
https://app.malva.re/file/1c933359b04ae4a76996a5a98d9072c0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0cfb4dce3fc6f73d908b626db6c546e40022d21429d7af369af4d88c2d3abcfa/
Threat name:
Win64.Trojan.BlackWidow
Create hunting rule
Status:
Malicious
First seen:
2025-07-27 12:09:14 UTC
File Type:
PE+ (Exe)
Extracted files:
20
AV detection:
12 of 37 (32.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bt5u3tr7y33t3eelmjw3nrkg4qacfuqufhl26nu26tmiylj2xt5a._file
Verdict:
malicious
Label(s):
latrodectus
Create hunting rule
Similar samples:
error
Latrodectus
Result
Malware family:
latrodectus
Create hunting rule
Score:
  10/10
Tags:
family:latrodectus loader
Link:
https://tria.ge/reports/250731-nhv4lshj2v/
Behaviour
Latrodectus family
Latrodectus loader
Malware Config
C2 Extraction:
https://asioklaydpory.com/work/
https://lasoriodrens.com/work/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b2bb9eb5-fb5e-43da-89f6-f45b9464dbe3
Unpacked files
SH256 hash:
0cfb4dce3fc6f73d908b626db6c546e40022d21429d7af369af4d88c2d3abcfa
MD5 hash:
1c933359b04ae4a76996a5a98d9072c0
SHA1 hash:
d45a7191779c72ffcb2055492df640a10bb83a0c
Link:
https://www.unpac.me/results/71d3a23b-632b-48dd-8396-4c3e0cbc63e4/
SH256 hash:
541d8be400a08e723909048310a62a9c61c6cf60729702d7f891bd910fb52bea
MD5 hash:
4d51619289f382cedc8fc91a936a8952
SHA1 hash:
b3c33d785bffe4b874d624eb1838a1a6e7ff4455
Detections:
win_latrodectus_g0
Create hunting rule
win_latrodectus_auto
Create hunting rule
LatrodectusAES
Create hunting rule
Link:
https://www.unpac.me/results/71d3a23b-632b-48dd-8396-4c3e0cbc63e4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0cfb4dce3fc6f73d908b626db6c546e40022d21429d7af369af4d88c2d3abcfa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Latrodectus_AES
Create hunting rule
Author:enzok
Description:Latrodectus Payload
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Latrodectus_841ff697
Create hunting rule
Author:Elastic Security
Rule name:win_latrodectus_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.latrodectus.
Rule name:win_unidentified_111_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.unidentified_111.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
Lumma
Cape
Cape
https://www.capesandbox.com/analysis/18002/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (FORCE_INTEGRITY)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll::ConvertStringSidToSidW
ADVAPI32.dll::EqualSid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::RevertToSelf
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::ImpersonateSelf
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenThreadToken
KERNEL32.dll::WriteProcessMemory
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::FindFirstVolumeW
KERNEL32.dll::FindNextVolumeW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::LookupAccountSidW
ADVAPI32.dll::LookupPrivilegeValueW
KERNEL32.dll::QueryDosDeviceW
WIN_BCRYPT_APICan Encrypt Filesbcrypt.dll::BCryptGenRandom
WIN_CRYPT_APIUses Windows Crypt APICRYPT32.dll::CertAddCertificateContextToStore
CRYPT32.dll::CertCreateCertificateChainEngine
CRYPT32.dll::CertEnumCertificatesInStore
CRYPT32.dll::CertFindCertificateInStore
CRYPT32.dll::CertFindExtension
CRYPT32.dll::CertFreeCertificateChain
CRYPT32.dll::CertFreeCertificateChainEngine
WIN_HTTP_APIUses HTTP servicesWINHTTP.dll::WinHttpCrackUrl
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyExW
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryInfoKeyW
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegQueryValueExW
WIN_SOCK_APIUses Network to send and receive dataWS2_32.dll::WSACloseEvent
WS2_32.dll::WSACreateEvent
WS2_32.dll::WSAEnumNetworkEvents
WS2_32.dll::WSAEventSelect
WS2_32.dll::WSAIoctl
WS2_32.dll::WSAResetEvent
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::ControlService
ADVAPI32.dll::OpenSCManagerW
ADVAPI32.dll::OpenServiceW
ADVAPI32.dll::QueryServiceStatusEx
ADVAPI32.dll::QueryServiceStatus
ADVAPI32.dll::StartServiceW

Comments