Latrodectus APR 2024

Latrodectus can resolve Windows APIs dynamically by hash.

TA577 has used LNK files to execute embedded DLLs.

Latrodectus has used a pseudo random number generator (PRNG) algorithm and a rolling XOR key to obfuscate strings.

Latrodectus can exfiltrate encrypted system information to the C2 server.

Latrodectus can create scheduled tasks for persistence.

Latrodectus can enumerate running processes including process grandchildren on targeted hosts.

TA577 has used BAT files in malware execution chains.

TA577 has used JavaScript to execute additional malicious payloads.

TA578 has used JavaScript files in malware execution chains.

Latrodectus can send registration information to C2 via HTTP `POST`.

Latrodectus can gather operating system information.

Latrodectus can collect desktop filenames.

Latrodectus has used a two-tiered C2 configuration with tier one nodes connecting to the victim and tier two nodes connecting to backend infrastructure.

Latrodectus can download and execute PEs, DLLs, and shellcode from C2.

IcedID has the ability to download additional modules and a configuration file from C2.

Latrodectus has Base64-encoded the message body of a HTTP request sent to C2.

Latrodectus has the ability to deobfuscate encrypted strings.

Latrodectus has been executed through malicious links distributed in email campaigns.

TA578 has placed malicious links in contact forms on victim sites, often spoofing a copyright complaint, to redirect users to malicious file downloads.

TA577 has lured users into executing malicious JavaScript files by sending malicious links via email.

Latrodectus has called `msiexec` to install remotely-hosted MSI files.

Latrodectus can determine if it is running in a virtualized environment by checking the OS version, checking the number of running processes, ensuring a 64-bit application is running on a 64-bit host, and checking if the host has a valid MAC address.

Latrodectus can set an AutoRun key to establish persistence.

Latrodectus has been distributed to victims through emails containing malicious links.

TA577 has sent emails containing links to malicious JavaScript files.

Latrodectus can send RC4 encrypted data over C2 channels.

TA578 has used Google Firebase to host malicious scripts.

TA577 has sent thread hijacked messages from compromised emails.

TA578 has filled out contact forms on victims' websites to direct them to adversary-controlled URLs.

Latrodectus has the ability to check for the presence of debuggers.