MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c99a006b725dfb7e7bf74e8ec7add1ff537a91576f047c47e9579ac59b3d08be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Latrodectus


Vendor detections: 13


Intelligence 13 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c99a006b725dfb7e7bf74e8ec7add1ff537a91576f047c47e9579ac59b3d08be
SHA3-384 hash: 99b231066f819dc78a643291107a39955ccdb5cd16f90f447b0237f808bb280c2d27d6704b736b4db0846f8e6fcbb6dd
SHA1 hash: 16c2ab22e9a11bf7a350fc115aac71c2fea94783
MD5 hash: d566997177e700dc474a1ef95b80d435
humanhash: montana-arizona-salami-washington
File name:xunyoucall.dll
Download: download sample
Signature Latrodectus
Create hunting rule
File size:3'436'608 bytes
First seen:2025-10-08 18:39:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6b5acc2e25d2f50f148e53d6fae4998e (1 x Latrodectus)
ssdeep 49152:HOqx6Ft1S1y5J5H14go4ylBmZ7kx/P5uOJ0bkxKiF3YcdAmiP255A4TjBWTBHaxC:HAmnrJYcPh55maxC
Threatray 33 similar samples on MalwareBazaar
TLSH T185F59D55E7A800E4C9B6D03CCAAB5617E3B2B41997B0AFDF0AB4526D0F237E5563E301
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter SquiblydooBlog
Tags:exe Latrodectus signed

Code Signing Certificate

Organisation:ECO BUILD HOUSE SP Z O O
Issuer:SSL.com EV Code Signing Intermediate CA RSA R3
Algorithm:sha256WithRSAEncryption
Valid from:2025-04-17T13:58:13Z
Valid to:2026-04-17T13:58:13Z
Serial number: 63a1d220486892587186887e3b99011e
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: cef3d272a075a248196f15634117aaf578a4680c2c3221e8588635313be95738
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
289
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
xunyoucall.dll
Verdict:
No threats detected
Analysis date:
2025-10-08 19:03:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1a2e8bc5-fd8b-4365-99ca-7b070484a724

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Latrodectus
Create hunting rule
Link:
https://www.capesandbox.com/analysis/31185/
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68e6afe57f305fa2545db24e
Tags:
shellcode injection smtp
Result
Verdict:
Clean
Maliciousness:
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context crypto expand fingerprint lolbin masquerade microsoft_visual_cc obfuscated packed remote signed threat
Link:
https://www.filescan.io/uploads/68e6b108d4a0085473c470cc/reports/f1ee7ab1-f9f6-44ba-a7b2-f1eed6f4d04a/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/c99a006b725dfb7e7bf74e8ec7add1ff537a91576f047c47e9579ac59b3d08be
Verdict:
Malicious
File Type:
dll x64
Detections:
Backdoor.Win64.Latrodectus.sb
Link:
https://opentip.kaspersky.com/c99a006b725dfb7e7bf74e8ec7add1ff537a91576f047c47e9579ac59b3d08be/results?tab=lookup
Malware family:
Latrodectus
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/428d3671-6840-4fd4-876b-9dcc72c6944f
Score:
20%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/c99a006b725dfb7e7bf74e8ec7add1ff537a91576f047c47e9579ac59b3d08be
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/d566997177e700dc474a1ef95b80d435
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c99a006b725dfb7e7bf74e8ec7add1ff537a91576f047c47e9579ac59b3d08be/
Verdict:
Malicious
Threat:
Family.LATRODECTUS
Link:
https://tip.neiki.dev/file/c99a006b725dfb7e7bf74e8ec7add1ff537a91576f047c47e9579ac59b3d08be
Threat name:
Win64.Trojan.Seheq
Create hunting rule
Status:
Malicious
First seen:
2025-10-08 18:49:32 UTC
File Type:
PE+ (Dll)
Extracted files:
1
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zgnaa23slx5x467xj2hmplor75jxvekxn4chyr7jk6nmlgz5bc7a._file
Verdict:
malicious
Label(s):
latrodectus
Create hunting rule
Similar samples:
328a8fb3ff41093c3b3352a6b3771e1d3351a04861ee73c7260ecb0e84aa51ff
Latrodectus
32f886142de76f09b1e7229a79e66eb46889251ebf871e4df3b6de7fd5cef749
Latrodectus
378127a840393f72bc2e98a1a3f54a57d05c08650dd485183a5554f0658632a8
Latrodectus
49c20938fbd31a92a359147b539de76d59be71abf7560801ecc497ca9c8ae809
Latrodectus
67c668d317076373447e8354a648c612043a667204889ca6e4cc10f8463f6684
Latrodectus
813c22cbeab8ac1f2d3571e16b1c45bef0e0743bbf27f0d5b2331829db81ea72
Latrodectus
a3b7ad3ac10b437dbe004aa6ec90b480a14304f2d5c59b77cb8559e96e1a6841
Latrodectus
c99a006b725dfb7e7bf74e8ec7add1ff537a91576f047c47e9579ac59b3d08be
Latrodectus
da6fbd0983a51f8a5f00bbcb2e26f7cb4adee36fa515c7e8cf12b9b4ea3acdec
Latrodectus
dd62428e997903e9d2b8e8319fe3a7a57d4e87599d46894b1f9f6f31f7872701
Latrodectus
error
Latrodectus
+ 23 additional samples on MalwareBazaar
Result
Malware family:
latrodectus
Create hunting rule
Score:
  10/10
Tags:
family:latrodectus loader
Link:
https://tria.ge/reports/251008-xdd4zawns8/
Behaviour
Latrodectus family
Latrodectus loader
Malware Config
C2 Extraction:
https://dakiloifhsnuukka.com/work/
https://erahitopupikloss.com/work/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/77b0bbe4-dc4a-4669-be8a-7bcfa28d9e56
Unpacked files
SH256 hash:
c99a006b725dfb7e7bf74e8ec7add1ff537a91576f047c47e9579ac59b3d08be
MD5 hash:
d566997177e700dc474a1ef95b80d435
SHA1 hash:
16c2ab22e9a11bf7a350fc115aac71c2fea94783
Link:
https://www.unpac.me/results/3b4b95e2-01a2-49b6-92d9-0f23098b0b23/
Malware family:
Latrodectus
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c99a006b725d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c99a006b725dfb7e7bf74e8ec7add1ff537a91576f047c47e9579ac59b3d08be

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/31185/

Comments