Arachnid alert: Latrodectus loader crawls through defences
Presents arachnid alert: Latrodectus loader crawls through defences and evaluates key implications for security practitioners.
Summary
Malware overview
VMRay's Albert introduces Latrodectus, first seen October 2023, as a loader/downloader with partial backdoor behavior, DLL payloads with four exports to one address, and links to TA577/TA578 and IcedID/Pikabot infrastructure.
Version evolution
Encryption moved from XOR with PRNG to rolling XOR/incrementer, then AES-CTR in v1.4+, with ongoing C2 command changes into 2025 v2.x.
Delivery
Early DocuSign-themed phishing led victims through obfuscated JavaScript to MSI installers bundling the DLL via custom actions. Recent campaigns injected sites with Cloudflare-themed clickfix overlays and Telegram-bot-driven JavaScript retrieval.
Evasion and analysis
Checks include process counts by Windows version, MAC address length, PEB BeingDebugged, and 32-on-64 process detection; anti-analysis uses runtime API resolution, CRC32 hashing, and evolving string encryption. Network beacons include a volume-serial-derived GUID and FNV1a-hashed campaign group IDs useful for detection.
Related talks
Virus Bulletin 2025·27 min
Provides goodbye loaders, hello RMM: the rise of legit software in ecrime campaigns and evaluates key implications for security practitioners.
Virus Bulletin 2025·22 min
Presents emmenhtal Loader: the silent enabler of modern malware campaigns and evaluates key implications for security practitioners.
Black Hat·25 min
Dario Nisi · Mariano Graziano · Yanick Fratantonio · Davide Balzarotti
Analysts investigate attack surfaces and defenses concerning Lost in the Loader: The Many Faces of the Windows PE File Format.