Arachnid alert: Latrodectus loader crawls through defences

Arachnid alert: Latrodectus loader crawls through defences

Speakers: Albert Zsigovits, Senior Malware Analyst, VMRay

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=opBBQRiWrVo

Overview

In this insightful talk at Virus Bulletin, Albert Zsigovits from VMRay presented a comprehensive analysis of Latrodectus, a rapidly evolving and sophisticated malware loader. First observed in October 2023, Latrodectus quickly gained notoriety as a multi-functional threat, operating as a loader, downloader, and partially a backdoor. Its emergence is particularly significant as it has been identified as a potential successor or substitute for high-profile malware families like IcedID and QakBot, with strong infrastructural ties to the former. The primary threat actors associated with its distribution, TA577 and TA578, are well-known for their involvement with these notorious predecessors.

The talk provided an in-depth look into Latrodectus's intricate mechanisms, highlighting its continuous development and adaptation. Zsigovits detailed the malware's progression through various versions, showcasing its advanced evasion and anti-analysis techniques, including a unique self-deletion script, hashed API calls, and sophisticated string encryption schemes. Despite these complexities, the research also uncovered consistent static indicators that offer robust detection opportunities for defenders. The presentation emphasized the malware's resilience, noting its continued activity and evolution even after a significant law enforcement takedown in May 2025, underscoring its persistent threat to the cybersecurity landscape.

Background

▶ Watch: Introduction to Latrodectus loader and its background (0:00)

The landscape of cyber threats is constantly shifting, with malware families emerging, evolving, and often replacing one another in response to defensive actions or strategic shifts by threat actors. Latrodectus arrived on this scene in October 2023, quickly drawing attention due to its capabilities and associations. Researchers classified it as a versatile loader, downloader, and even a partial backdoor, signifying its capacity not just to deliver subsequent payloads but also to maintain persistence and execute commands on compromised systems.

Its critical context lies in its connection to prominent threat groups TA577 and TA578, notorious for deploying QakBot and IcedID. The talk explicitly positions Latrodectus as a "substitute for IcedID," citing strong ties in infrastructure between the two. This suggests that Latrodectus may have been developed or adopted to fill the void left by IcedID, especially after periods of disruption or takedowns affecting its predecessors. Furthermore, its functional and modular similarities to Pikabot, another prevalent malware loader, indicate that its developers are leveraging established and effective malware architectures. The problem Latrodectus addresses for its operators is clear: providing a resilient, adaptable, and potent initial access vector and payload delivery mechanism in an ever-more scrutinized threat environment. This demand drives the continuous innovation seen in its evasion techniques, anti-analysis measures, and delivery methods.

Key Findings

▶ Watch: New delivery technique via compromised websites and iframes (4:00)

The comprehensive analysis of Latrodectus revealed several critical findings that underscore its sophistication and persistent threat:

• Rapid and Continuous Evolution: Latrodectus has undergone significant version changes in a short period, demonstrating active development. This includes fundamental shifts in its core encryption schemes, progressing from XOR encryption with a PRNG function to rolling XOR with a simple incrementer, and finally to AES-256 CTR mode with a hard-coded key. Each iteration introduced new C2 commands and refined internal algorithms.
• Sophisticated Evasion and Anti-Analysis Techniques: The malware employs a diverse array of methods to thwart detection and analysis. These include environmental checks like process count verification (50 processes for older Windows, 75 for newer), MAC address length validation, probing the Process Environment Block (PEB) for the BeingDebugged flag, and even checking if it's running as a 32-bit process within a 64-bit OS. For anti-analysis, it utilizes runtime API resolving by walking the PEB, API hashing with CRC32 for DLLs and exported functions, and complex multi-stage string encryption.
• Evolving Delivery Mechanisms: Latrodectus's distribution methods have adapted over time. Initially, it spread via phishing emails leveraging DocuSign-themed lures that led to malicious JavaScript and MSI files containing embedded DLL payloads. More recently, it adopted a novel technique involving vulnerable website injection, displaying an iframe overlay with a Cloudflare CAPTCHA and employing clickjacking to trick users into executing JavaScript that communicates with a Telegram bot for payload retrieval.
• Unique Self-Deletion Capability: The malware integrates a specific self-deletion technique derived from an open-source GitHub project by Lloyd Labs. This method involves manipulating file handles and renaming data streams to delete the running executable from disk, although it required an update to bypass a patch introduced in Windows 11 24H2.
• Comprehensive C2 Functionality and Next-Stage Payloads: Latrodectus acts as a versatile backdoor, capable of receiving over 20 distinct C2 commands for reconnaissance, bot maintenance (updates, termination), and downloading subsequent payloads. Observed next-stage payloads include Sysinfo.bin (reconnaissance), SDKM.bin (stealer for browser data and credentials), and even web injects targeting specific banks.
• Resilience to Takedowns and Persistent Threat: Despite a significant law enforcement takedown of malicious infrastructure in May 2025, which temporarily impacted its activity, Latrodectus quickly rebounded. Telemetry showed a clear drop followed by a "small spike and again some increasing trajectory of distribution," confirming its survival and continued development, emphasizing the persistent nature of the threat.
• Contradictory Detection Opportunities: While highly sophisticated, Latrodectus surprisingly retains several consistent, static elements across all samples. These "good detection points" include a fixed mutex, specific user agents, a hard-coded AES key (in later versions), and a unique GUID calculation (serial volume ID multiplied by a static value). These provide strong anchors for YARA signatures and other detection mechanisms, offering defenders a crucial advantage.

Technical Deep Dive

▶ Watch: Latrodectus's self-deletion technique and Windows patch (13:00)

Latrodectus demonstrates a nuanced blend of common and advanced techniques, evolving rapidly to maintain its efficacy against defensive measures.

Versioning and Encryption Schemes

The evolution of Latrodectus's encryption is a testament to its active development.

• Versions 1.1A and Early 1.x: Initially, XOR encryption was employed, using a pseudo-random number generator (PRNG) function to seed the key. Encrypted strings were stored in the data section. The first four bytes of each encrypted chunk served as both the XOR key and a delimiter. The fifth and sixth bytes indicated the size of the encrypted string data. Subsequent early versions simplified this by removing the PRNG and switching to a rolling XOR with a simple incrementer, but maintained the same byte structure for key, size, and data.
• Version 1.4 Onwards: A significant shift occurred in July 2024 with the introduction of AES-256 encryption in CTR mode. This version incorporated a hard-coded key within each payload. The algorithm for string decryption changed: the first two bytes of each chunk now represented the data length, followed by 16 bytes serving as the Initialization Vector (IV), with the remaining bytes being the encrypted data. This change significantly increased the complexity of static string extraction.

Delivery Mechanisms

Latrodectus has adapted its delivery methods to overcome evolving defenses:

• Early Distribution (Phishing): Initial campaigns heavily relied on phishing emails, often themed around legitimate services like DocuSign. Victims were enticed to click on links leading to malicious JavaScript. This JavaScript, often heavily obfuscated with numerous commented lines, would assemble a plaintext script to pull an MSI file from a remote server. These MSI files were typically legitimate installers for popular software, but they were weaponized: the Latrodectus DLL payload was embedded within them, and a custom action launch file parameter was used to execute the DLL upon MSI installation.
• Recent Distribution (Website Injection/Clickjacking): A newer, more sophisticated technique involves injecting JavaScript into vulnerable websites. This JavaScript displays an iframe overlay over the legitimate site content, often mimicking a Cloudflare CAPTCHA. This setup is designed for clickjacking, tricking users into copying and executing commands. The executed JavaScript then connects to a Telegram channel where a bot provides instructions and delivers the Latrodectus payload.

Evasion Techniques

The malware incorporates several checks to detect and evade analysis environments:

• Process Count Check: This targets sandboxes and automated analysis systems. Latrodectus uses RtlGetVersion and GetVersionExW API calls to determine the Windows OS version. If running on Windows 7, 8, or 8.1, it requires at least 50 active processes; for Windows 10 or 11, this threshold increases to 75 processes. If the count is below these thresholds, the malware may not proceed.
• MAC Address Check: It utilizes the GetAdaptersInfo API call to enumerate network adapters. It then verifies if the MAC address length of an Ethernet adapter is precisely six bytes. While standard, this check might be aimed at highly specialized or emulated environments where network interfaces might deviate from standard configurations.
• PEB BeingDebugged Flag: A more common, yet effective, technique involves inspecting the Process Environment Block (PEB) to check the BeingDebugged flag. This is often considered a "smarter" approach than simply calling IsDebuggerPresent, as it bypasses simple API hooks.
• 32-bit in 64-bit OS Check: Latrodectus uses GetCurrentProcess to ascertain if it's running as a 32-bit process within a 64-bit Windows OS. This is somewhat questionable, as all Latrodectus payloads are 64-bit DLLs and would typically run as such. However, it might be a heuristic to detect specific emulation scenarios.

Anti-Analysis Techniques

Beyond evasion, Latrodectus actively complicates analysis:

• Runtime API Resolving: To avoid static detection of API imports, the malware resolves critical API functions at runtime. It walks the PEB to find the base addresses of kernel32.dll and ntdll.dll, then uses LoadLibraryW to dynamically load libraries and GetProcAddress (or a similar technique) to resolve required functions.
• API Hashing: For further obfuscation, Latrodectus employs API hashing. It walks the system32 folder, comparing the filenames of DLLs against pre-computed CRC32 hash values. The same hashing mechanism is applied to the exported functions of these DLLs, making it harder to identify the malware's intended API calls through static analysis.
• String Encryption: As detailed under "Versioning and Encryption Schemes," string encryption is a core anti-analysis technique. The methods vary by version, but all aim to hide critical strings (e.g., C2 addresses, campaign names, API names) from plain view in memory dumps or static disassembly.

Network Communication and C2

When active, Latrodectus initiates network requests to its C2 server, incorporating specific identifiers:

• GUID and Group ID: The very first network request includes a GUID, which is uniquely generated by multiplying the victim's serial volume ID with a hard-coded value. This specific calculation serves as a "very good detection point" due to its consistency across all samples. It also sends a group ID, derived from an FNV1a hash of the decrypted campaign name, which is itself an encrypted string stored in the malware's configuration.
• C2 Endpoints: Early versions of Latrodectus used /live and /testdrive as C2 endpoints, while more recent versions consistently use /work. Network traffic itself is often encrypted using an RC4 key.
• C2 Infrastructure: Analysis of C2 addresses revealed a significant portion hosted within Cloudflare's ASN, though this can be misleading as Cloudflare acts as a proxy. More tellingly, a substantial number of C2 servers were found in the Meta Spinner ASN. This ASN has a history of hosting over 2,000 malware sites, with 250 still online, and is flagged by resources like URLhouse and Spamhaus as being under cybercriminal control, often exhibiting deceptive business practices regarding peering agreements.

Self-Deletion Mechanism

Latrodectus implements a specific self-deletion technique to remove its footprint from the compromised system. This method, identified as originating from an open-source GitHub project by Lloyd Labs, involves:

1. Opening a handle to the target file (the running process) with DELETE access.
2. Using the SetFileInformationByHandle API call to rename the file's main data stream (e.g., to :Zone.Identifier).
3. Closing the handle.
4. Opening another handle to the file, but this time with the FILE_FLAG_DELETE_ON_CLOSE flag set.
5. Closing this second handle, which causes the file of the currently running process to "magically just disappear from the disk."

This technique worked until Windows 11 24H2, where a Microsoft patch broke it. However, a simple fix involves including the POSIX_SEMANTICS flag in the code to restore functionality.

C2 Commands and Next-Stage Payloads

The malware functions as a backdoor, capable of receiving a wide array of commands (over 20 distinct IDs) from its C2 server, grouped into three categories:

• Enumeration/Reconnaissance (Commands 2-4): These gather information from the victim's host.
• Maintenance Commands: These include updating the bot, terminating, or killing the process.
• Next-Stage Payload Delivery: This crucial function allows Latrodectus to download and execute additional malware. Top observed shellcodes include:
• Sysinfo.bin: A reconnaissance module executing commands like net user to gather host information.
• SDKM.bin: A stealer module designed to extract browser cookies, saved credentials, and login information.
• Web Inject: A module targeting specific banks to pull credentials directly from browser sessions, an "interesting observation" given the perceived decline in web inject activity.

Demo / Proof of Concept

▶ Watch: Analysis of next-stage payloads: sysinfo, stealer, web injects (16:20)

While the talk did not feature a live demonstration of a specific tool or a proof-of-concept exploit, Albert Zsigovits comprehensively described the analytical processes and techniques developed by VMRay to understand and counter Latrodectus. This included detailing how a Python script could be used to iterate through the data section of Latrodectus payloads to decrypt strings, given knowledge of the specific encryption algorithms for each version. Furthermore, the speaker explained how campaign names could be brute-forced by applying the FNV1a hashing function to generated word lists, enabling researchers to identify prevalent campaigns like "mimiccast." The presentation effectively served as a deep dive into the analysis and decryption methodology, providing the technical underpinnings for defenders to create their own tools or detections.

Defensive Implications

▶ Watch: Latrodectus's survival and continued development post-takedown (20:00)

The detailed analysis of Latrodectus provides numerous actionable insights for defenders, enabling them to build robust detection and prevention strategies.

• Leverage Static Detection Opportunities: Despite its sophistication, Latrodectus consistently uses several static values that are excellent anchor points for detection. Security teams should develop YARA signatures and other static rules to identify:
• The fixed mutex and user agents present across all samples.
• The hard-coded AES key used in versions 1.4 and later.
• Specific markers in the code indicating the exact malware version.
• The unique GUID calculation (serial volume ID multiplied by a specific hard-coded value).
• Monitor for Evasion Techniques: Implement behavioral detection rules for the specific API calls and conditions Latrodectus uses for evasion:
• Monitor for RtlGetVersion and GetVersionExW followed by process count checks (e.g., suspicious processes querying process lists and then terminating).
• Watch for GetAdaptersInfo calls verifying MAC address lengths.
• Detect attempts to read the BeingDebugged flag in the PEB.
• Network-Based Detections:
• Block known C2 endpoints: /live, /testdrive (older), and especially /work (newer).
• Monitor for the distinct initial network request containing the unique GUID and FNV1a-hashed campaign ID.
• Block communication to the Meta Spinner ASN (AS208886) and other identified malicious infrastructure, as flagged by threat intelligence sources like URLhouse and Spamhaus.
• Look for RC4-encrypted network traffic to C2 servers.
• Behavioral Analysis of Delivery Methods:
• Implement robust email filtering for phishing emails, especially those with DocuSign lures or malicious JavaScript attachments.
• Monitor for MSI files executing custom actions that launch embedded DLLs.
• Detect website injection leading to iframe overlays, Cloudflare CAPTCHA impersonations, and clickjacking attempts.
• Identify and block suspicious JavaScript communicating with Telegram channels or bots.
• Self-Deletion Detection:
• Monitor for the specific sequence of API calls involved in the self-deletion technique: opening a handle with DELETE access, SetFileInformationByHandle to rename data streams, followed by opening another handle with FILE_FLAG_DELETE_ON_CLOSE.
• Ensure systems are updated, particularly Windows 11 24H2 and later, to benefit from Microsoft's patch, though it's important to note the POSIX_SEMANTICS flag fix.
• Next-Stage Payload Monitoring:
• Develop detections for the observed next-stage payloads: Sysinfo.bin (reconnaissance activities like net user commands), SDKM.bin (attempts to access browser cookies, credentials), and web injects (targeting financial institutions).
• Threat Intelligence Integration: Stay updated on threat intelligence related to TA577, TA578, IcedID, QakBot, and Pikabot, as Latrodectus is closely tied to these groups and their tactics. This context can help anticipate evolving threats.
• Endpoint Detection and Response (EDR) Rules: Configure EDR solutions to flag suspicious process behavior, API call sequences, and file system manipulations characteristic of Latrodectus, including its persistence mechanisms and attempts to load subsequent payloads.

By combining these defensive strategies, organizations can significantly enhance their ability to detect, prevent, and respond to Latrodectus infections, even as the malware continues to evolve.

Key Takeaways

• Latrodectus is a Highly Evolving and Resilient Threat: Since its emergence in October 2023, Latrodectus has undergone rapid versioning and significant technical overhauls, including fundamental changes to its encryption schemes and delivery methods, demonstrating active development and a high degree of adaptability.
• Sophisticated Evasion and Anti-Analysis: The malware employs a multi-layered approach to evade detection, featuring environmental checks (process count, MAC address), PEB introspection for debuggers, runtime API resolving, API hashing (CRC32), and complex, version-dependent string encryption.
• Survival Post-Takedown Highlights Persistence: Despite a major law enforcement takedown in May 2025 targeting its infrastructure, Latrodectus quickly rebounded, confirming its resilience and continued operation, underscoring the persistent nature of this threat.
• Contradictory Detection Opportunities Exist: Despite its advanced techniques, Latrodectus contains several consistent, static indicators across samples (e.g., fixed mutex, user agents, hard-coded AES key, unique GUID calculation) that provide robust and reliable detection points for defenders.
• Evolving Delivery and C2: Latrodectus has diversified its initial access vectors from traditional phishing with malicious MSIs to sophisticated website injection, clickjacking, and Telegram bot communication. Its C2 infrastructure, including the use of flagged ASNs like Meta Spinner, also offers valuable blocking opportunities.
• Multi-layered Defense is Crucial: Effective defense against Latrodectus requires a combination of static and behavioral analysis, network traffic monitoring, robust email and web filtering, and proactive threat intelligence integration, leveraging both its advanced capabilities and its unexpected static weaknesses.

About the Speaker(s)

Albert Zsigovits is a Senior Malware Analyst at VMRay. This talk marked his second appearance at the Virus Bulletin conference, and his first time presenting in person, having previously delivered a remote talk during the COVID era. His expertise lies in deep-dive malware analysis, as evidenced by his detailed breakdown of Latrodectus, from its intricate encryption schemes and evasion techniques to its delivery mechanisms and C2 infrastructure. His work at VMRay focuses on understanding and dissecting complex malware families to provide actionable intelligence for the cybersecurity community.