MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69af1d10dd1dacae362ab8fd4e5bcc97ddb363cdeb06a4bf1bc3db4dfc68b1e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Latrodectus


Vendor detections: 14


Intelligence 14 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69af1d10dd1dacae362ab8fd4e5bcc97ddb363cdeb06a4bf1bc3db4dfc68b1e1
SHA3-384 hash: 47b842fe516e33bcbde564c8d6ab48eab7e1649d912a4cb33d6ab5a8ff64f6f98cf2aff7194b2d27d032fdb8699d4678
SHA1 hash: 6b0c0a35d0020700cc2baf744eb3b2a250945bbf
MD5 hash: bbb2eb34fed468b8ec5cd0be88f9acbb
humanhash: arkansas-blossom-early-mike
File name:mwtsp.dll
Download: download sample
Signature Latrodectus
Create hunting rule
File size:1'907'472 bytes
First seen:2025-05-16 14:26:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3765aee2a76a4886e70915c41193dd1b (1 x Latrodectus)
ssdeep 49152:D8Gt/xpMse6b/WClEuBKH5jRfyMwUTig:deUWClEe6
Threatray 1 similar samples on MalwareBazaar
TLSH T1A1958E56E37540E8D0BBD17ACA579613EAB034090730ABDF96A4DE517F13BE2A63E700
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter smica83
Tags:exe Latrodectus signed

Code Signing Certificate

Organisation:Wuxi Weitai Nano Technology Co., Ltd.
Issuer:GlobalSign GCC R45 EV CodeSigning CA 2020
Algorithm:sha256WithRSAEncryption
Valid from:2025-04-21T09:11:11Z
Valid to:2026-04-22T09:11:11Z
Serial number: 5f36ff3efcf0620ed7d1fd6c
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: c9a6b61f85967659287d8e1f083791e8e4a7517ba66c6ad06270d73edd2abd67
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
569
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
mal.7z
Verdict:
Malicious activity
Analysis date:
2025-05-13 13:42:23 UTC
Tags:
arch-exec latrodectus
Link:
https://app.any.run/tasks/5c94f4f3-875f-480c-96e4-ed92dac65498

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win64.Malware-gen.25872.7066.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
98.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68274b104a59e5a2ce053c0c
Tags:
shellcode dropper virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context evasive explorer fingerprint lolbin masquerade microsoft_visual_cc packed remote rundll32 signed
Link:
https://www.filescan.io/uploads/68274b0b0de036ed65a9fd70/reports/0c26942f-f1b8-4894-abf6-c541da1e9941/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/69af1d10dd1dacae362ab8fd4e5bcc97ddb363cdeb06a4bf1bc3db4dfc68b1e1
Malware family:
Latrodectus
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0e6ba64f-6482-4a8e-acc6-3bc7bd43e390
Result
Threat name:
Latrodectus
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1692061
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to detect sleep reduction / modifications
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected Latrodectus
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1692061 Sample: mwtsp.dll.exe Startdate: 16/05/2025 Architecture: WINDOWS Score: 100 29 domtrst455.com 2->29 31 daringdesigners.com 2->31 37 Suricata IDS alerts for network traffic 2->37 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 5 other signatures 2->43 8 loaddll64.exe 1 2->8         started        signatures3 process4 signatures5 47 Contains functionality to detect sleep reduction / modifications 8->47 11 cmd.exe 1 8->11         started        13 rundll32.exe 8->13         started        15 rundll32.exe 8->15         started        17 29 other processes 8->17 process6 process7 19 rundll32.exe 12 11->19         started        23 WerFault.exe 20 16 13->23         started        25 WerFault.exe 16 15->25         started        27 WerFault.exe 16 17->27         started        dnsIp8 33 daringdesigners.com 104.21.0.84, 443, 49715, 49717 CLOUDFLARENETUS United States 19->33 35 domtrst455.com 104.21.45.217, 443, 49716, 49718 CLOUDFLARENETUS United States 19->35 45 System process connects to network (likely due to code injection or exploit) 19->45 signatures9
Score:
34%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/69af1d10dd1dacae362ab8fd4e5bcc97ddb363cdeb06a4bf1bc3db4dfc68b1e1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69af1d10dd1dacae362ab8fd4e5bcc97ddb363cdeb06a4bf1bc3db4dfc68b1e1/
Threat name:
Win64.Trojan.Latrodectus
Create hunting rule
Status:
Malicious
First seen:
2025-05-16 11:55:10 UTC
File Type:
PE+ (Dll)
Extracted files:
2
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ngxr2eg5dwwk4nrkxd6u4w6ms7o3gy6n5mdkjpy3ypnu37diwhqq._file
Verdict:
malicious
Label(s):
latrodectus
Create hunting rule
Similar samples:
69af1d10dd1dacae362ab8fd4e5bcc97ddb363cdeb06a4bf1bc3db4dfc68b1e1
Latrodectus
error
Latrodectus
Result
Malware family:
latrodectus
Create hunting rule
Score:
  10/10
Tags:
family:latrodectus loader
Link:
https://tria.ge/reports/250516-rry4eahn7z/
Behaviour
Latrodectus family
Latrodectus loader
Malware Config
C2 Extraction:
https://daringdesigners.com/work/
https://domtrst455.com/work/
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d5eca714-619b-4c44-9752-9b356f4de19c
Unpacked files
SH256 hash:
69af1d10dd1dacae362ab8fd4e5bcc97ddb363cdeb06a4bf1bc3db4dfc68b1e1
MD5 hash:
bbb2eb34fed468b8ec5cd0be88f9acbb
SHA1 hash:
6b0c0a35d0020700cc2baf744eb3b2a250945bbf
Link:
https://www.unpac.me/results/aca30e0a-f7c5-4cd4-9b3d-1d75df743b5c/
Malware family:
Latrodectus
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/69af1d10dd1d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/69af1d10dd1dacae362ab8fd4e5bcc97ddb363cdeb06a4bf1bc3db4dfc68b1e1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:iot_req_metachar
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://x.com/malwrhunterteam/status/1923351849098228049?t=y6XK5fGl1uAspL-Cvj-lJA&s=19

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::GetSidSubAuthority
ADVAPI32.dll::GetSidSubAuthorityCount
ADVAPI32.dll::IsValidSid
ADVAPI32.dll::RevertToSelf
ADVAPI32.dll::GetSecurityDescriptorSacl
USER32.dll::GetUserObjectSecurity
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
RPC_APICan Execute Remote ProceduresRPCRT4.dll::RpcStringFreeA
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::DuplicateToken
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetSecurityDescriptorOwner
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::ImpersonateLoggedOnUser
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserA
KERNEL32.dll::CreateProcessA
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
ADVAPI32.dll::OpenThreadToken
WINHTTP.dll::WinHttpCloseHandle
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetDriveTypeA
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleA
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileMappingA
KERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::CreateFileW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::GetUserNameA
ADVAPI32.dll::LookupAccountNameW
ADVAPI32.dll::LookupAccountSidA
ADVAPI32.dll::LookupPrivilegeValueA
KERNEL32.dll::QueryDosDeviceA
WIN_HTTP_APIUses HTTP servicesWINHTTP.dll::WinHttpAddRequestHeaders
WINHTTP.dll::WinHttpConnect
WINHTTP.dll::WinHttpCrackUrl
WINHTTP.dll::WinHttpOpenRequest
WINHTTP.dll::WinHttpOpen
WINHTTP.dll::WinHttpQueryDataAvailable
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegCreateKeyA
ADVAPI32.dll::RegNotifyChangeKeyValue
ADVAPI32.dll::RegOpenKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryValueExA
WIN_SOCK_APIUses Network to send and receive dataWS2_32.dll::WSAIoctl
WS2_32.dll::WSARecv
WS2_32.dll::WSASetEvent
WS2_32.dll::WSAWaitForMultipleEvents
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::OpenSCManagerA
ADVAPI32.dll::OpenServiceA
ADVAPI32.dll::QueryServiceStatus
ADVAPI32.dll::StartServiceA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::CloseDesktop
USER32.dll::OpenInputDesktop
USER32.dll::PeekMessageA
USER32.dll::CreateWindowExA

Comments