MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aef5c150cfe8154ed290b293e30d552cfb9b40b3552369345c7c2f135b63aac4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Latrodectus


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aef5c150cfe8154ed290b293e30d552cfb9b40b3552369345c7c2f135b63aac4
SHA3-384 hash: 46801d0da6aa2a14a8c8ef776d7cfefd176ecec75905104da62927f18035206b6e9e16b9ea86caec106ae0e8f6a08787
SHA1 hash: be928f3d6903df2740c98a611ea204d940d61509
MD5 hash: 4b7e693cd154ff08ba9593fab4f8cf77
humanhash: queen-white-red-florida
File name:649e2d.msi
Download: download sample
Signature Latrodectus
Create hunting rule
File size:5'283'328 bytes
First seen:2025-04-16 11:11:36 UTC
Last seen:2025-04-16 12:50:34 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 98304:6YVK/AKIO+9ryVzg+VojBTg3rsY0QuJGz85yil6FTPpAX2uV50cVrhE0:++9VjBTQrx18EikFTpi6aG0
Threatray 255 similar samples on MalwareBazaar
TLSH T1C83612227386C63BC86D02707929879F156DFDA30B7180DBA3D82D2E5CB15C16B39F96
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter SquiblydooBlog
Tags:"LLC KancEra" architrata-com Latrodectus msi signed

Code Signing Certificate

Organisation:LLC KancEra
Issuer:GlobalSign GCC R45 EV CodeSigning CA 2020
Algorithm:sha256WithRSAEncryption
Valid from:2025-04-08T07:29:57Z
Valid to:2026-04-09T07:29:57Z
Serial number: 2280f29ddaa0c67f38bc8ff4
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: f46a2c810bfe5c219c8b691e11bb4c74a8f1f27ff8d7b7a12a6c0e015f94271a
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
85
Origin country :
US US
Vendor Threat Intelligence
Detection:
Latrodectus
Create hunting rule
Link:
https://www.capesandbox.com/analysis/2445/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67ff9179954c9c53de0bb7a4
Tags:
shellcode
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-vm cmd crypto expired-cert fingerprint invalid-signature keylogger lolbin remote revoked-cert signed wix
Link:
https://www.filescan.io/uploads/67ff908ae9c1e257979acdfc/reports/76f9cefc-fa4a-4d80-a5e3-1d0040ef3908/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/aef5c150cfe8154ed290b293e30d552cfb9b40b3552369345c7c2f135b63aac4
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/aef5c150cfe8154ed290b293e30d552cfb9b40b3552369345c7c2f135b63aac4
Score:
74%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/aef5c150cfe8154ed290b293e30d552cfb9b40b3552369345c7c2f135b63aac4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aef5c150cfe8154ed290b293e30d552cfb9b40b3552369345c7c2f135b63aac4/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2025-04-16 00:55:38 UTC
File Type:
Binary (Archive)
Extracted files:
985
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v324cugp5aku5uuqwkj6gdkvft5zwqftkurwsnc4pqxrgw3dvlca._file
Verdict:
malicious
Label(s):
latrodectus
Create hunting rule
Similar samples:
0905db293dbc6be00cbdcfad4888d9702f2563a11b339d99656f6b8898a8ac10
Latrodectus
19fba13375784918bd8880efbb95cd8f8dbc7402b445ec828fcb09f3a7722cdc
Latrodectus
1f7f3dccaefd26d851d86d52504a5047bbea41e4d762f138346c0839d772b9b8
Latrodectus
3b86c9516bd5d57758ab976e32af2d7873d7ad0b0e063a49ee13c168f2c1e980
Latrodectus
4bf33d5531fe319bed3d1550608ded652ef6b52437b6cc94d47a0d388f5bb03b
Latrodectus
ec3ca0877e599ae9c40cbcec51a9a4718114e33d9e2d9d8c72f5f24d7cebdcbf
Latrodectus
error
Latrodectus
+ 245 additional samples on MalwareBazaar
Result
Malware family:
latrodectus
Create hunting rule
Score:
  10/10
Tags:
family:latrodectus discovery loader persistence privilege_escalation
Link:
https://tria.ge/reports/250416-naw1yavms8/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Enumerates connected drives
Detects Latrodectus
Latrodectus family
Latrodectus loader
Malware Config
C2 Extraction:
https://carflotyup.com/test/
https://architrata.com/test/
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c25d16db-f461-4662-a77c-8ae80b200ac5
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_LATAM_MSI_Banker
Create hunting rule
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/2445/

Comments