LatrodectusMalware
- blackwidow
- icenova
- unidentified 111
First discovered in October 2023, BLACKWIDOW is a backdoor written in C that communicates over HTTP using RC4 encrypted requests. The malware has the capability to execute discovery commands, query information about the victim's machine, update itself, as well as download and execute an EXE, DLL, or shellcode.From MISP Galaxy
Last reported 12 months ago, by The DFIR Report1 report
ATT&CK techniques
6 of 46 · each with the sentence it comes from- T1003.001LSASS Memory
“LSASS Memory - T1003.001”
- T1018Remote System Discovery
“Remote System Discovery - T1018”
- T1021.001Remote Desktop Protocol
“Remote Desktop Protocol - T1021.001”
- T1021.002SMB/Windows Admin Shares
“SMB/Windows Admin Shares - T1021.002”
- T1027.013Encrypted/Encoded File
“Encrypted/Encoded File - T1027.013”
- T1027.016Junk Code Insertion
“Junk Code Insertion - T1027.016”
What the reports say
1 report, newest first · the exact sentence from each-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“Multiple types of malware were deployed across the intrusion, including Latrodectus, Brute Ratel C4, Cobalt Strike, BackConnect, and a custom .NET backdoor.”
Indicators in its reports
named in the reports above- hxxp://91.194.11[.]64/MSI.msiin 1 report
- 91.194.11[.]64in 1 report
- disk1[.]cabin 1 report
- 193.168.143[.]196in 1 report
- hxxps://cloudmeri[.]com/comm.phpin 1 report
- cloudmeri[.]comin 1 report
- hxxp://45.129.199[.]214/vodeo/wg01ck01in 1 report
- 45.129.199[.]214in 1 report
- 94.232.40[.]49in 1 report
- techbulldigital[.]comin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.