MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Latrodectus


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf
SHA3-384 hash: b629fccf7cad24f342213a1ca3e5c3967a2ebb7982bd0b10a5c28241feb7a137fa4fb7786250796d0bd59792467d7787
SHA1 hash: 0d805a684b889846a7b00cecc0ee84c7cf93398d
MD5 hash: 309abcad11b67d2498cf87c4e10ff30f
humanhash: red-india-carbon-item
File name:merd.msi
Download: download sample
Signature Latrodectus
Create hunting rule
File size:2'048'000 bytes
First seen:2024-11-19 20:24:41 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:ecS3YhW8zBQSc0ZnSKBZKumZr7AQkojSo0kzI8ZVE6VPbe:sYY0Zn3K/AQz3Tbx56
Threatray 300 similar samples on MalwareBazaar
TLSH T14195E12233C6C537D96E01702A2AD76B5579FCB74B3140D7A3C8292E9EB44C1A639F93
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter pr0xylife
Tags:BruteRatel Latrodectus msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
DE DE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=673cf4b77b9ab5fcc4db8c73
Tags:
ransomware shellcode
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
cmd fingerprint lolbin packed remote wix
Link:
https://www.filescan.io/uploads/673cf420a99242316c491530/reports/38a77ae3-716a-4bdb-948a-e06776a9016e/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1558852
Signature
AI detected suspicious sample
Drops executables to the windows directory (C:\Windows) and starts them
Sets debug register (to hijack the execution of another thread)
Sigma detected: Potentially Suspicious Malware Callback Communication
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
Score:
91%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf/
Threat name:
Win32.Backdoor.Brutel
Create hunting rule
Status:
Malicious
First seen:
2024-11-19 20:25:06 UTC
File Type:
Binary (Archive)
Extracted files:
38
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yonl3sq2ggza7ydjngrwcawhqtpx6y4ep3etbx5prrf5s62flc7q._file
Verdict:
malicious
Label(s):
bruteratelc4
Create hunting rule
Similar samples:
025abbec1724b9180b369fe116da9d90ae47a4996f6a4e28e8a947bac1e0c741
Latrodectus
06a9283d0374be0ba13f645b13cca80601595d7d608aa18c9a4c9ce323af03db
Latrodectus
14ffcbbfb305287ea15264df3363567f36a26917ae2018af0f40e2009b8a7184
Latrodectus
3f948bcd8c16b6e2c20fec3e9126a730b835888a4f071391c7847b00a27d8dd8
Latrodectus
c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf
Latrodectus
c3f8ebc9cfb7ebe1ebbe3a4210753b271fecf73392fef98519b823a3e7c056c7
Latrodectus
error
Latrodectus
+ 290 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery persistence privilege_escalation
Link:
https://tria.ge/reports/241119-y69xsasfpp/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Enumerates connected drives
Blocklisted process makes network request
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/23863de0-4906-4669-9cea-c7ec3546b25b
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c39abdca1a31/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_LATAM_MSI_Banker
Create hunting rule
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments