Malpedia: Latrodectus (win.latrodectus)

First discovered in October 2023, BLACKWIDOW is a backdoor written in C that communicates over HTTP using RC4 encrypted requests. The malware has the capability to execute discovery commands, query information the victim's machine, update itself, as well as download and execute an EXE, DLL, or shellcode. The malware is believed to have been developed by LUNAR SPIDER, the creators of IcedID (aka BokBot) Malware.

ClickFix in action: how a fake captcha can encrypt an entire company

Spamhaus Botnet Threat Update July to December 2025

Malcat scripting tutorial: deobfuscating Latrodectus

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

Spamhaus Botnet Threat Update January to June 2025

Threat actors leverage tax season to deploy tax-themed phishing campaigns

Latrodectus Malware Delivered via Telegram Bot/Chat API

Spamhaus Botnet Threat Update July to December 2024

Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape

Inside Intelligence Center: LUNAR SPIDER Enabling Ransomware Attacks on Financial Sector with Brute Ratel C4 and Latrodectus

Inside the Latrodectus Malware Campaign Old School Phishing Meets Innovative Payload Delivery

Pronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader

Latrodectus Extracting new AES encrypted strings from this RAT

Latrodectus Rapid Evolution Continues With Latest New Payload Features

Latrodectus Rapid Evolution Continues With Latest New Payload Features

Latrodectus Malware Masquerades as AhnLab Security Software to Infect Victims

Double Trouble: Latrodectus and ACR Stealer observed spreading via Google Authenticator Phishing Site

Malware Campaign Lures Users With Fake W2 Form

Latrodectus Affiliate Resumes Operations Using Brute Ratel C4 Post Operation Endgame

Inside LATRODECTUS: A Dive into Malware Tactics and Mitigation

Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID

[Case Study: Latrodectus] Analyzing and Implementing String Decryption Algorithms

Latrodectus [IceNova] – Technical Analysis of the… New IcedID… Its Continuation… Or its Replacement?

Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover

Passive DNS For Phishing Link Analysis - Identifying 36 Latrodectus Domains With Historical Records and 302 Redirects

Latrodectus Deobfuscation - Removal of Junk and Self-Referencing Code

2024-03-07 (THURSDAY): LATRODECTUS INFECTION LEADS TO LUMMA STEALER

DanaBot's Latest Move: Deploying Latrodectus

author = "Felix Bilstein - yara-signator at cocacoding dot com"

info = "autogenerated rule brought to you by yara-signator"

signator_config = "callsandjumps;datarefs;binvalue"

malpedia_reference = "

malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"

* The strings used in this rule have been automatically selected from the

* disassembly of memory dumps and unpacked files, using YARA-Signator.

* The code and documentation is published here:

*

* As Malpedia is used as data source, please note that for a given

* number of families, only single samples are documented.

* This likely impacts the degree of generalization these rules will offer.

* Take the described generation method also into consideration when you

* apply the rules in your use cases and assign them confidence levels.

$sequence_0 = { e8???????? 89442424 8b442428 39442424 7404 33c0 eb47 }

// 89442424 | mov ecx, dword ptr [esp + 0xd0]

// 8b442428 | dec eax

// 39442424 | mov dword ptr [esp + 0x40], 0

// 7404 | mov edx, 0x250

// 33c0 | dec eax

// eb47 | lea ecx, [esp + 0x90]

$sequence_1 = { 4533c9 440fb7442470 488b542468 488b4c2440 ff15???????? 4889442448 48837c244800 }

// 4533c9 | mov ecx, dword ptr [esp + 0x20]

// 440fb7442470 | inc esp

// 488b542468 | mov ecx, ecx

// 488b4c2440 | inc ebp

// 4889442448 | xor ecx, ecx

// 48837c244800 | inc esp

$sequence_2 = { e9???????? 48c744244000000000 ba50020000 488d8c2490000000 e8???????? 488d942490000000 488b4c2420 }

// 48c744244000000000 | and eax, 0xff

// ba50020000 | sub eax, edx

// 488d8c2490000000 | dec eax

// 488d942490000000 | mov ecx, dword ptr [esp + 0x40]

// 488b4c2420 | mov dword ptr [ecx + 0x108], eax

$sequence_3 = { 488b4c2440 488b09 e8???????? 8b4c2420 448bc9 }

// 488b4c2440 | dec eax

// 488b09 | mov ecx, dword ptr [esp + 0x40]

// 8b4c2420 | dec eax

// 448bc9 | mov ecx, dword ptr [ecx]

$sequence_4 = { 488b842488000000 4889442428 488d442458 4889442420 4533c9 4533c0 33d2 }

// 488b842488000000 | dec eax

// 4889442428 | mov eax, dword ptr [esp + 0x40]

// 488d442458 | mov ecx, 0x64

// 4889442420 | xor edx, edx

// 4533c9 | dec eax

// 4533c0 | mov ecx, dword ptr [esp + 0xd0]

// 33d2 | dec eax

$sequence_5 = { b964000000 e8???????? e9???????? 33d2 488b8c24d0000000 ff15???????? 488b8c24d0000000 }

// b964000000 | mov dword ptr [esp + 0x48], eax

// 33d2 | dec eax

// 488b8c24d0000000 | cmp dword ptr [esp + 0x48], 0

// 488b8c24d0000000 | add eax, edx

$sequence_6 = { 03c2 25ff000000 2bc2 488b4c2440 898108010000 488b442440 }

// 03c2 | movzx eax, word ptr [esp + 0x70]

// 25ff000000 | dec eax

// 2bc2 | mov edx, dword ptr [esp + 0x68]

// 488b4c2440 | dec eax

// 898108010000 | mov ecx, dword ptr [esp + 0x40]

// 488b442440 | dec eax

$sequence_7 = { 0f84c9000000 488b442428 8b4c2458 8908 488b4c2460 e8???????? }

// 0f84c9000000 | dec eax

// 488b442428 | lea edx, [esp + 0x90]

// 8b4c2458 | dec eax

// 8908 | mov ecx, dword ptr [esp + 0x20]

// 488b4c2460 | dec eax

$sequence_8 = { 0faee8 e8???????? 8b451b 894304 0f10451f 0f114308 0f104d2f }

// 0faee8 | mov edx, dword ptr [esp + 0x78]

// 8b451b | dec eax

// 894304 | lea ecx, [esp + 0x28]

// 0f10451f | dec eax

// 0f114308 | mov ecx, dword ptr [esp + 0x78]

// 0f104d2f | dec eax

$sequence_9 = { 48634804 48837c314800 450f45f5 440b743110 440bf3 4183e617 4489743110 }

// 48634804 | xor eax, eax

// 48837c314800 | dec eax

// 450f45f5 | mov ecx, dword ptr [esp + 0x40]

// 440b743110 | dec eax

// 440bf3 | arpl word ptr [ecx + 0x108], cx

// 4183e617 | dec eax

// 4489743110 | mov edx, dword ptr [esp + 0x40]

$sequence_10 = { 3bd1 7d43 2bca 4863f9 85c9 7e3a 0f1f00 }

// 3bd1 | movzx ecx, byte ptr [edx + ecx]

// 7d43 | add eax, ecx

// 4863f9 | and edx, 0xff

// 85c9 | dec eax

// 7e3a | lea ecx, [esp + 0x28]

// 0f1f00 | dec eax

$sequence_11 = { 483bfd 75c6 488bac2490000000 498bc6 49891e 488b4c2458 4833cc }

// 483bfd | dec eax

// 75c6 | cmp dword ptr [esp + 0x20], 0

// 488bac2490000000 | jne 0x1d

// 498bc6 | mov eax, dword ptr [esp]

// 49891e | dec eax

// 488b4c2458 | mov ecx, dword ptr [esp + 0x20]

// 4833cc | movsx eax, byte ptr [ecx + eax]

$sequence_12 = { 4157 488dac2430fcffff 4881ecd0040000 488b05???????? 4833c4 488985c0030000 498bd8 }

// 4157 | test eax, eax

// 488dac2430fcffff | jne 0xf

// 4881ecd0040000 | jmp 0x1e

// 4833c4 | mov eax, dword ptr [esp]

// 488985c0030000 | cmp eax, 0x7a

// 498bd8 | jg 0x11

$sequence_13 = { 4883781807 7603 488b00 ba14000000 895c2428 4889442420 4d8b4d38 }

// 4883781807 | mov ecx, dword ptr [esp + 0x40]

// 7603 | dec eax

// 488b00 | mov dword ptr [esp + 0x48], eax

// ba14000000 | dec eax

// 895c2428 | cmp dword ptr [esp + 0x48], 0

// 4889442420 | jne 0xf

// 4d8b4d38 | jmp 0x15

$sequence_14 = { 0f1145f8 f20f104f10 f20f114d08 8b4718 894510 48634714 85c0 }

// 0f1145f8 | add esp, 0x38

// f20f114d08 | dec eax

// 8b4718 | mov dword ptr [esp + 8], ecx

// 894510 | dec eax

// 48634714 | sub esp, 0x18

// 85c0 | mov dword ptr [esp], 0

$sequence_15 = { 0f95c0 84c0 741e 4885c9 750b 488d0d90110700 48894b40 }

// 0f95c0 | movsx eax, byte ptr [esp + 0x20]

// 84c0 | sub eax, 0x47

// 741e | mov word ptr [esp + 0x24], ax

// 4885c9 | jmp 0x1b

// 750b | dec eax

// 488d0d90110700 | mov eax, dword ptr [esp + 0x40]

// 48894b40 | jne 8