Procedure examples

Latrodectus can collect data from a compromised host using a stealer module.

Latrodectus can discover the IP and MAC address of a targeted host.

Latrodectus has routed C2 traffic using Keyhole VNC.

Latrodectus has been obfuscated with a 129 byte sequence of junk data prepended to the file.

The Latrodectus payload has been packed for obfuscation.

Latrodectus can resolve Windows APIs dynamically by hash.

Latrodectus has used a pseudo random number generator (PRNG) algorithm and a rolling XOR key to obfuscate strings.

Latrodectus can discover the username of an infected host.

Latrodectus has been packed to appear as a component to Bitdefender’s kernel-mode driver, TRUFOS.SYS.

Latrodectus can exfiltrate encrypted system information to the C2 server.

Latrodectus has used WMI in malicious email infection chains to facilitate the installation of remotely-hosted files.

Latrodectus can create scheduled tasks for persistence.

Latrodectus can enumerate running processes including process grandchildren on targeted hosts.

The Latrodectus command handler can use `cmdexe` to run multiple discovery commands.

Latrodectus has used JavaScript files as part its infection chain during malicious spam
email campaigns.

Latrodectus can identify domain groups through `cmd.exe /c net group "Domain Admins" /domain`.

Latrodectus has the ability to delete itself.

Latrodectus can send registration information to C2 via HTTP `POST`.

Latrodectus can gather operating system information.

Latrodectus can collect desktop filenames.

Latrodectus can run `C:\Windows\System32\cmd.exe /c net group "Domain Admins" /domain` to identify domain administrator accounts.

Latrodectus has used Google Firebase to download malicious installation scripts.

Latrodectus has used a two-tiered C2 configuration with tier one nodes connecting to the victim and tier two nodes connecting to backend infrastructure.

Latrodectus can download and execute PEs, DLLs, and shellcode from C2.

Latrodectus has used multiple Windows API post exploitation including `GetAdaptersInfo`, `CreateToolhelp32Snapshot`, and `CreateProcessW`.

Latrodectus has Base64-encoded the message body of a HTTP request sent to C2.

Latrodectus can run `C:\Windows\System32\cmd.exe /c net view /all` to discover network shares.

Latrodectus has the ability to deobfuscate encrypted strings.

Latrodectus has been executed through malicious links distributed in email campaigns.

Latrodectus has lured users into opening malicious email attachments for execution.

Latrodectus has called `msiexec` to install remotely-hosted MSI files.

Latrodectus can use rundll32.exe to execute downloaded DLLs.

Latrodectus can run `C:\Windows\System32\cmd.exe /c nltest /domain_trusts` to discover domain trusts.

Latrodectus can determine if it is running in a virtualized environment by checking the OS version, checking the number of running processes, ensuring a 64-bit application is running on a 64-bit host, and checking if the host has a valid MAC address.

Latrodectus has the ability to identify installed antivirus products.

Latrodectus has the ability to restart compromised hosts.

Latrodectus can set an AutoRun key to establish persistence.

Latrodectus can use the Windows Component Object Model (COM) to set scheduled tasks.

Latrodectus can delete itself while its process is still running through the use of an alternate data stream.

Latrodectus has been distributed through reply-chain phishing emails with malicious attachments.

Latrodectus has been distributed to victims through emails containing malicious links.

Latrodectus can send RC4 encrypted data over C2 channels.

Latrodectus has the ability to check for the presence of debuggers.