Latrodectus
- ID
- S1160
- Type
- Malware
- Associated names
- IceNova, Unidentified 111
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 1 Oct 2024
Latrodectus is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. Latrodectus has most often been distributed through email campaigns, primarily by TA577 and TA578, and has infrastructure overlaps with historic IcedID operations.[1][2][3]
Techniques used (43)
- T1005 Data from Local System
- T1016 System Network Configuration Discovery
- T1021.005 VNC
- T1027.001 Binary Padding
- T1027.002 Software Packing
- T1027.007 Dynamic API Resolution
- T1027.013 Encrypted/Encoded File
- T1033 System Owner/User Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1041 Exfiltration Over C2 Channel
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1059.007 JavaScript
- T1069.002 Domain Groups
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087.002 Domain Account
- T1102 Web Service
- T1104 Multi-Stage Channels
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1132.001 Standard Encoding
- T1135 Network Share Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1218.007 Msiexec
- T1218.011 Rundll32
- T1482 Domain Trust Discovery
- T1497.001 System Checks
- T1518.001 Security Software Discovery
- T1529 System Shutdown/Reboot
- T1547.001 Registry Run Keys / Startup Folder
- T1559.001 Component Object Model
- T1564.004 NTFS File Attributes
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1573.001 Symmetric Cryptography
- T1622 Debugger Evasion