Latrodectus Malware Impersonates AhnLab Software and Uses Identified C2 Infrastructure
Summary
Researchers analyzed a Latrodectus DLL posing as AhnLab software and traced associated command-and-control servers and domains using certificate and infrastructure pivots. The malware can establish persistence and deploy additional payloads, including Brute Ratel C4.
Key points
- MeDExt.dll impersonated AhnLab Smart Defense’s MeD Engine Extension; the file was unsigned and detected as a downloader.
- The researchers could not establish the campaign’s initial access method; phishing and malicious ads were noted as possible routes, with a cited Symantec bulletin identifying phishing.
- Latrodectus can execute remote commands, gather information, and deploy additional payloads, including Brute Ratel C4.
- The analyzed sample used Windows COM to create a scheduled task for persistence.
- Sandbox analysis observed C2 requests to stripplasst[.]com/live/ and coolarition[.]com/live/ and captured an initial victim-registration POST.
- Certificate, JA4X, port, and hosting pivots identified additional possible Latrodectus-associated infrastructure; the researchers cautioned that not all matches were confirmed.
- The article lists associated IPs, domains, and file hashes as network and host observables.
Article Details
- Attack Vectors
- The initial access method was unknown to the researchers; phishing and malicious ads were described as likely entry points based on past reports.
- The malware masqueraded as AhnLab security software. Symantec separately identified phishing as the initial access vector for the campaign.
- Latrodectus used Windows COM to set a scheduled task for persistence.
- Defensive Notes
- Scrutinize renamed files that impersonate trusted security software.
- Continuously monitor and analyze network activity.
- Treat registrar patterns and certificate characteristics as low-confidence indicators; the researchers cautioned that such characteristics are also used legitimately and by other threat actors.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | riscoarchez[.]com | Domain that resolved to a Latrodectus C2 IP and was associated with a Brute Ratel C4 attack, according to the article. |
| SHA256 | 23546ec67474ed6788a14c9410f3fc458b5c5ff8bd13885100fb4f3e930a30bf | Hash of MeDExt.dll, identified as a malicious Latrodectus downloader. |
| SHA256 | 62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830 | Hash of GoogleAuthSetup.ex, described as a malicious file associated with Latrodectus. |
| SHA256 | a459ce4bfb5d649410231bd4776c194b0891c8c5328bafc22184fe3111c0b3e7 | Hash of confrontation_d46a184c.exe, listed with domains it was seen communicating with. |
MITRE ATT&CK
Malware
Brute Ratel C4from compromised machines, and deploy additional malicious payloads, the most recent being Brute Ratel C4.LatrodectusDuring a recent analysis of known Latrodectus infrastructure, our research team encountered a command-and-control (C2) server at 103.144.139.]189 after pivoting on the TLS certificates. Communicating with this server
Vendors
Products
AhnLab Smart DefenseDLL file that caught our attention, "MeDExt.dll," mimics the legitimate MeD Engine Extension from AhnLab Smart Defense. Given that this malicious file is a DLL, it's plausible that the legitimate parent executable wasGoogle Authenticatorcombinations on the same ASN as our initial IP, we found a malicious file mimicking the Google Authenticator app, also associated with Latrodectus communicating with 103.144.139.]182.