Latrodectus, are you coming back? | Bitsight – Cyber Security News Aggregator

At the end of May 2024, the largest ever operation against botnets, dubbed Operation Endgame, targeted several botnets including IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee, and Trickbot. This operation significantly impacted the botnets by compromising their operations and shutting down their infrastructure. Although Latrodectus was not mentioned in the operation, it was also affected and its infrastructure went offline. As pointed out in this article by Proofpoint and Team Cymru S2, the infrastructure of Latrodectus and IcedID overlapped with each other.

Latrodectus is a loader capable of downloading and executing additional payloads and modules to extend its own functionally. Active since at least October 2023, this malware is usually distributed through email spam campaigns, primarily by two threat actors known as TA577 and TA578.

In this article we provide a technical analysis of Latrodectus and some insights about its victims up until Operation Endgame.

Blog contents:

Latrodectus bot analysis

Upon execution, Latrodectus resolves all needed Windows APIs by hash, performs checks to determine if it is running inside a sandbox, and checks for other instances of itself to avoid infecting the same machine twice. If the system passes these checks, the malware installs itself and registers with the command and control (C2) server. Once registered, the bot stays in a loop to request additional instructions.

Anti analysis

Upon starting, Latrodectus ensures that it is not running in a contained environment like a sandbox. If any of the steps described below fail, the malware aborts execution.

Debugger check

This check simply verifies if the BeingDebugged flag is set in the Process Environment Block (PEB).

Field	Description
counter	total number HTTP requests
type	beacon type. 1 is normal beacon, 2 is running outside of Appdata, 3 sysinfo beacon, 4 process list beacon, 5 desktop links beacon
guid	bot ID string
os	major version of Windows
arch	always 1 which refers to x64
username	string
group	FNV-1a hash of group string aka campaign identifier
ver	major and minor version of the malware. known versions are 1.1, 1.2, and 1.3
up	hardcoded value that changes between samples
direction	current c2 domain to where the request is sent

Extra field	Description
mac	list of mac addresses of the infected system, each mac needs to end with a ;
computername	hostname of the infected system
domain	domain name. if system is not part of a domain this field is filled with a –

Instruction	Description
URLS	sends a new server to be stored in the update C2 table at a given index
CLEARURL	cleanup/reset update C2 table
COMMAND	sends a command to be executed by the bot. the commands are identified by an ID number
ERROR	sends error message to bot

Command ID	Description
2	Collect desktop filenames
3	Collect running processes
4	Collect sysinfo
12	Download and execute EXE file
13	Download and execute DLL file via rundll32
14	Download and execute shellcode
15	Download and execute update EXE file (self update)
17	Uninstall
18	Download and execute Anubis aka IcedID
19	Extra sleep (increase next sleep time)
20	Reset counter (http request counter)
21	Download and execute stealer module

Command	Extra field
request public ip from https://ifconfig.me	realip
cmd.exe /c ipconfig /all	ipconfig
cmd.exe /c systeminfo	systeminfo
cmd.exe /c nltest /domain_trusts	domain_trusts
cmd.exe /c nltest /domain_trusts /all_trusts	domain_trusts_all
cmd.exe /c net view /all /domain	net_view_all_domain
cmd.exe /c net view /all	net_view_all
cmd.exe /c net group “Domain Admins” /domain	net_group
wmic.exe /Node:localhost /Namespace:rootSecurityCenter2 Path AntiVirusProduct Get * /Format:List	wmic
cmd.exe /c net config workstation	net_config_ws
cmd.exe /c wmic.exe /node:localhost /namespace:rootSecurityCenter2 path AntiVirusProduct Get DisplayName \| findstr /V /B /C:displayName \|\| echo No Antivirus installed	net_wmic_av
cmd.exe /c whoami /groups	whoami_group

Latrodectus, are you coming back? | Bitsight

Latrodectus bot analysis

Anti analysis

Debugger check

C2 decryption

The update data .dat file

Persistence

Communications protocol

Beacon data

C2 instructions and commands

Command ID 2 – Collect desktop files

Command ID 3 – Collect running processes

Command ID 4 – Collect sysinfo

Command ID 21 – Download and exec stealer module

Campaigns and victims

Conclusion

Indicators

File hashes

C2 domains

RC4 keys

Group	Group ID (FNV-1a hash)
test	2949673445
Novik	1053565364
Olimp	445271760
Liniska	2020984416
Trust	2317793045
Supted	1081065992
Littlehw	510584660
Facial	3828029093
Electrol	2221766521
Compati	3581839234