Elastic Latrodectus May 2024

Latrodectus can discover the IP and MAC address of a targeted host.

Latrodectus has been obfuscated with a 129 byte sequence of junk data prepended to the file.

The Latrodectus payload has been packed for obfuscation.

Latrodectus has used a pseudo random number generator (PRNG) algorithm and a rolling XOR key to obfuscate strings.

Latrodectus can discover the username of an infected host.

Latrodectus has been packed to appear as a component to Bitdefender’s kernel-mode driver, TRUFOS.SYS.

Latrodectus has used WMI in malicious email infection chains to facilitate the installation of remotely-hosted files.

Latrodectus can create scheduled tasks for persistence.

Latrodectus can enumerate running processes including process grandchildren on targeted hosts.

The Latrodectus command handler can use `cmdexe` to run multiple discovery commands.

Latrodectus has used JavaScript files as part its infection chain during malicious spam
email campaigns.

Latrodectus can identify domain groups through `cmd.exe /c net group "Domain Admins" /domain`.

Latrodectus has the ability to delete itself.

Latrodectus can send registration information to C2 via HTTP `POST`.

Latrodectus can gather operating system information.

Latrodectus can collect desktop filenames.

Latrodectus can run `C:\Windows\System32\cmd.exe /c net group "Domain Admins" /domain` to identify domain administrator accounts.

Latrodectus can download and execute PEs, DLLs, and shellcode from C2.

Latrodectus has used multiple Windows API post exploitation including `GetAdaptersInfo`, `CreateToolhelp32Snapshot`, and `CreateProcessW`.

Latrodectus has Base64-encoded the message body of a HTTP request sent to C2.

Latrodectus can run `C:\Windows\System32\cmd.exe /c net view /all` to discover network shares.

Latrodectus has the ability to deobfuscate encrypted strings.

Latrodectus can use rundll32.exe to execute downloaded DLLs.

Latrodectus can run `C:\Windows\System32\cmd.exe /c nltest /domain_trusts` to discover domain trusts.

Latrodectus can determine if it is running in a virtualized environment by checking the OS version, checking the number of running processes, ensuring a 64-bit application is running on a 64-bit host, and checking if the host has a valid MAC address.

Latrodectus has the ability to identify installed antivirus products.

Latrodectus has the ability to restart compromised hosts.

Latrodectus can use the Windows Component Object Model (COM) to set scheduled tasks.

Latrodectus can delete itself while its process is still running through the use of an alternate data stream.

Latrodectus can send RC4 encrypted data over C2 channels.