MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfff1a07429ff9585f3dab9c78b501174e7c326e1fb95c5234368071b5426768. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Latrodectus


Vendor detections: 11


Intelligence 11 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dfff1a07429ff9585f3dab9c78b501174e7c326e1fb95c5234368071b5426768
SHA3-384 hash: f6e5e9a38c12050d72aba8201cf5bbef386e7fbeab4ee658891d35ad0f75e6b3aa7de43e1045cf0b05a5359b5de45c5d
SHA1 hash: dfc980a827dbde294ae9fa6e63545d1d57344e96
MD5 hash: 8cb04bf931a19fa0ae1bd7235180dd4a
humanhash: failed-missouri-single-asparagus
File name:medk.msi
Download: download sample
Signature Latrodectus
Create hunting rule
File size:2'131'456 bytes
First seen:2024-11-13 17:18:43 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:F943YhW8zBQSc0ZnSKBZKumZr7Apj3Y+7jHplNa:6YY0Zn3K/Al3dXHpra
Threatray 265 similar samples on MalwareBazaar
TLSH T169A5E12273C6C537C9AE01307A1AD66A547DFCA70B3140DBA3C8292EAD745C16739FA7
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter pr0xylife
Tags:BruteRatel Latrodectus msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
3'322
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen30.2783.11992.7601.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67351aff34b6906b3482974f
Tags:
shellcode emotet virus gates
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug cmd fingerprint keylogger lolbin packed remote wix
Link:
https://www.filescan.io/uploads/6734df897bda433cc0d21b73/reports/74dfd4ec-289d-444e-ab47-947d0e2b333d/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/dfff1a07429ff9585f3dab9c78b501174e7c326e1fb95c5234368071b5426768
Result
Threat name:
BruteRatel, Latrodectus
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1555319
Signature
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Malicious sample detected (through community Yara rule)
Sample uses string decryption to hide its real strings
Sets debug register (to hijack the execution of another thread)
Sigma detected: RunDLL32 Spawning Explorer
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Yara detected BruteRatel
Yara detected Latrodectus
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1555319 Sample: medk.msi Startdate: 13/11/2024 Architecture: WINDOWS Score: 100 39 samomol.com 2->39 41 ergiholim.com 2->41 43 2 other IPs or domains 2->43 57 Suricata IDS alerts for network traffic 2->57 59 Found malware configuration 2->59 61 Malicious sample detected (through community Yara rule) 2->61 63 7 other signatures 2->63 8 rundll32.exe 2->8         started        10 msiexec.exe 14 40 2->10         started        14 msiexec.exe 2 2->14         started        signatures3 process4 file5 16 rundll32.exe 8 12 8->16         started        27 C:\Windows\Installer\MSI8F42.tmp, PE32 10->27 dropped 29 C:\Users\user\AppData\Roaming\tab.dll, PE32+ 10->29 dropped 31 C:\Windows\Installer\MSI8E17.tmp, PE32 10->31 dropped 33 3 other files (none is malicious) 10->33 dropped 65 Drops executables to the windows directory (C:\Windows) and starts them 10->65 20 msiexec.exe 10->20         started        22 MSI8F42.tmp 10->22         started        signatures6 process7 dnsIp8 35 samomol.com 87.120.37.120, 49982, 9043 NETERRA-ASBG Bulgaria 16->35 37 burjog.com 45.143.166.230, 49710, 49711, 50009 ITTITT-ASRU Russian Federation 16->37 49 System process connects to network (likely due to code injection or exploit) 16->49 51 Contains functionality to inject threads in other processes 16->51 53 Injects code into the Windows Explorer (explorer.exe) 16->53 55 5 other signatures 16->55 24 explorer.exe 54 1 16->24 injected signatures9 process10 dnsIp11 45 ergiholim.com 104.21.15.162, 443, 49989, 49991 CLOUDFLARENETUS United States 24->45 47 rolefenik.com 104.21.92.105, 443, 49988, 49990 CLOUDFLARENETUS United States 24->47
Score:
91%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/dfff1a07429ff9585f3dab9c78b501174e7c326e1fb95c5234368071b5426768
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dfff1a07429ff9585f3dab9c78b501174e7c326e1fb95c5234368071b5426768/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=377rub2ct74vqxz5voohrnibc5hhymtod64vyurug2ahdnkcm5ua._file
Verdict:
malicious
Label(s):
bruteratelc4
Create hunting rule
latrodectus
Create hunting rule
Similar samples:
025abbec1724b9180b369fe116da9d90ae47a4996f6a4e28e8a947bac1e0c741
Latrodectus
06a9283d0374be0ba13f645b13cca80601595d7d608aa18c9a4c9ce323af03db
Latrodectus
07282b92613d88cdeb02dc30835216268c7ec378bb0ff7a08bb280775a8f82c3
Latrodectus
1822636a57752d06999da566e21c16b1f0dc465e225af2c2afba6ffb1cde0512
Latrodectus
3f948bcd8c16b6e2c20fec3e9126a730b835888a4f071391c7847b00a27d8dd8
Latrodectus
error
Latrodectus
f02ba578e0f962f6be46187b288e22a4dbe972878893ecb81ff5f33944aef4b4
Latrodectus
+ 255 additional samples on MalwareBazaar
Result
Malware family:
latrodectus
Create hunting rule
Score:
  10/10
Tags:
family:latrodectus discovery loader persistence privilege_escalation
Link:
https://tria.ge/reports/241113-vvtvmswdnb/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Enumerates connected drives
Blocklisted process makes network request
Detects Latrodectus
Latrodectus family
Latrodectus loader
Malware Config
C2 Extraction:
https://rolefenik.com/test/
https://ergiholim.com/test/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fb87da30-ccb7-4c61-81eb-b6c4dc86bcad
Malware family:
Latrodectus
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dfff1a07429f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dfff1a07429ff9585f3dab9c78b501174e7c326e1fb95c5234368071b5426768

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_LATAM_MSI_Banker
Create hunting rule
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:suspicious_msi_file
Create hunting rule
Author:Johnk3r
Description:Detects common strings, DLL and API in Banker_BR

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments