MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 658b8c47d7193c7c31a2540b2f54fcdfb9298d8346a4ad3be7e684ef946f57a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Latrodectus

Vendor detections: 8

Intelligence 8 IOCs YARA 9 File information Comments

SHA256 hash:	658b8c47d7193c7c31a2540b2f54fcdfb9298d8346a4ad3be7e684ef946f57a5
SHA3-384 hash:	1bf7b0551651b040f362020e0398a37f57136f9caa425ecf570928fb72004a3be82db1124177af44df187c3d71b25cfe
SHA1 hash:	490453e5eeaaf89071a29c68548314d1e9b21592
MD5 hash:	371fe9184f46204250bcb30fe62f3a08
humanhash:	papa-mountain-vegan-india
File name:	fes.msi
Download:	download sample
Signature	Latrodectus Create hunting rule
File size:	2'200'576 bytes
First seen:	2024-12-03 16:42:03 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	49152:pXE3YQW8zBQSc0ZnSKBZKumZr7AaIGQ5rr0Go:UYH0Zn3K/AafII
Threatray	273 similar samples on MalwareBazaar
TLSH	T1B6A5F12273C6C537C96E01302A29D66B557DFCB74B3140D7A3C8291EAE744C1A63AFA7
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	k3dg3___
Tags:	BruteRatel BruteRatelC4 Latrodectus msi

Intelligence

File Origin

# of uploads :

# of downloads :

134

Origin country :

Vendor Threat Intelligence

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674f35fc12e85e185e75646c

Tags:

shellcode

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

cmd fingerprint lolbin remote

Link:

https://www.filescan.io/uploads/674f351b266b360b01e4a64b/reports/bde96aaa-6f91-4e98-98f0-0a71ae6d6b5a/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/658b8c47d7193c7c31a2540b2f54fcdfb9298d8346a4ad3be7e684ef946f57a5

Result

Threat name:

BruteRatel, Latrodectus

Detection:

malicious

Classification:

spre.bank.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1567646

Signature

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Checks if browser processes are running

Contains functionality to inject threads in other processes

Contains functionality to steal Internet Explorer form passwords

Creates a thread in another existing process (thread injection)

Drops executables to the windows directory (C:\Windows) and starts them

Found malware configuration

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Performs a network lookup / discovery via net view

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sets debug register (to hijack the execution of another thread)

Sigma detected: RunDLL32 Spawning Explorer

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Uses ipconfig to lookup or modify the Windows network settings

Uses net.exe to modify the status of services

Uses whoami command line tool to query computer and username

Writes to foreign memory regions

Yara detected BruteRatel

Yara detected Latrodectus

Behaviour

Behavior Graph:

Download SVG

Score:

91%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/241203-t78nwsyrej/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Enumerates connected drives

Blocklisted process makes network request

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/c6f2c768-0d54-4971-b19d-4e70fb4bcc81

Malware family:

Latrodectus

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/658b8c47d719/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/658b8c47d7193c7c31a2540b2f54fcdfb9298d8346a4ad3be7e684ef946f57a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_LATAM_MSI_Banker Create hunting rule

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	suspicious_msi_file Create hunting rule
Author:	Johnk3r
Description:	Detects common strings, DLL and API in Banker_BR

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)