Latrodectus Loader – Script Obfuscation via Junk Comments and Self-Referencing Code (upd.msi sample)

Key facts for Latrodectus junk-comment loader

Detection coverage for Latrodectus junk-comment loader

As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4805 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Latrodectus MSI Payload Execution via msiexec Spawned by WmiPrvSE (upd.msi WebDAV)

Detects the Latrodectus stage-3 pattern from the Embee Research upd.msi sample (TL-2026-4805): msiexec.exe launched under wmiprvse.exe via WMI (the VBScript-style stage breaks the obvious script-to-msiexec parent-child chain), msiexec installing a known Latrodectus WebDAV MSI (upd.msi, gsm.msi, escape.msi, cisa.msi) or fetching from sokingscrosshotel.com or a DavWWWRoot / @80 WebDAV path, or msiexec doing a quiet install straight from a URL. Behaviour-first: the WMI parent is the primary signal and does not depend on the IOC list staying current.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1218.007, T1047, T1202, T1105, T1059.005
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
( (Image="*\\msiexec.exe" ParentImage="*\\wmiprvse.exe")
OR (Image="*\\msiexec.exe" (CommandLine="*upd.msi*" OR CommandLine="*gsm.msi*" OR CommandLine="*escape.msi*" OR CommandLine="*cisa.msi*" OR CommandLine="*sokingscrosshotel.com*" OR CommandLine="*DavWWWRoot*" OR CommandLine="*@80\\*"))
OR (Image="*\\msiexec.exe" CommandLine="*://*" (CommandLine="* /i*" OR CommandLine="* -i*") (CommandLine="* /q*" OR CommandLine="* -q*")) )
| eval detection_branch=case(match(lower(ParentImage),"wmiprvse\\.exe$"),"msiexec_spawned_by_wmiprvse", match(CommandLine,"(?i)(upd|gsm|escape|cisa)\\.msi|sokingscrosshotel\\.com|DavWWWRoot|@80"),"known_latrodectus_webdav_msi_or_remote_path", true(),"msiexec_quiet_install_from_url")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by host User ParentImage Image detection_branch
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "msiexec.exe"
| where InitiatingProcessFileName =~ "wmiprvse.exe"
    or ProcessCommandLine has_any ("upd.msi", "gsm.msi", "escape.msi", "cisa.msi", "sokingscrosshotel.com", "DavWWWRoot", "@80\\")
    or (ProcessCommandLine has "://" and ProcessCommandLine has_any (" /i", " -i") and ProcessCommandLine has_any (" /q", " -q"))
| extend DetectionBranch = case(InitiatingProcessFileName =~ "wmiprvse.exe", "msiexec_spawned_by_wmiprvse", ProcessCommandLine has_any ("upd.msi", "gsm.msi", "escape.msi", "cisa.msi", "sokingscrosshotel.com", "DavWWWRoot", "@80\\"), "known_latrodectus_webdav_msi_or_remote_path", "msiexec_quiet_install_from_url")
| project Timestamp, DeviceName, AccountName, DetectionBranch, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc

Sigma

title: Latrodectus MSI Execution via msiexec Spawned by WmiPrvSE or Known WebDAV MSI
id: 3f6b1c52-8d4e-4a17-9b2c-5e0a71d4c801
status: experimental
description: Detects msiexec.exe spawned by wmiprvse.exe (WMI-based execution used by the Latrodectus JavaScript loader to hide the parent chain), msiexec installing known Latrodectus WebDAV MSI payloads (upd.msi, gsm.msi, escape.msi, cisa.msi) or from sokingscrosshotel.com / WebDAV paths, and quiet msiexec installs directly from a URL.
references:
    - https://www.embeeresearch.io/latrodectus-script-deobfuscation/
    - https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice
    - https://www.levelblue.com/blogs/levelblue-blog/analyzing-latrodectus-the-new-face-of-malware-loaders
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-30
tags:
    - attack.defense-evasion
    - attack.execution
    - attack.command-and-control
    - attack.t1218.007
    - attack.t1047
    - attack.t1202
    - attack.t1105
    - attack.t1059.005
    - attack.s1160
logsource:
    category: process_creation
    product: windows
detection:
    selection_wmi_parent:
        Image|endswith: '\msiexec.exe'
        ParentImage|endswith: '\wmiprvse.exe'
    selection_known_msi:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains:
            - 'upd.msi'
            - 'gsm.msi'
            - 'escape.msi'
            - 'cisa.msi'
            - 'sokingscrosshotel.com'
            - 'DavWWWRoot'
            - '@80\'
    selection_url_img:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains: '://'
    selection_url_install:
        CommandLine|contains:
            - ' /i'
            - ' -i'
    selection_url_quiet:
        CommandLine|contains:
            - ' /q'
            - ' -q'
    condition: selection_wmi_parent or selection_known_msi or (selection_url_img and selection_url_install and selection_url_quiet)
falsepositives:
    - Software deployment or inventory tooling that launches Windows Installer through WMI (for example Win32_Product.Install or SCCM-style remote installs)
    - Administrators silently installing internally hosted MSI packages from an HTTP URL
level: high

Known false positives:

• Legitimate software deployment or patching tools that invoke msiexec through WMI (Win32_Product.Install, remote install scripts)
• Administrators installing internally hosted MSI packages from a WebDAV, @80 or HTTP share

Tuning notes: Allowlist known deployment servers and service accounts in the User / ParentCommandLine fields, and baseline msiexec children of wmiprvse.exe for 14 days before alerting. Keep the WMI-parent branch always on; the filename and domain branch is IOC-based and should be refreshed as new Latrodectus MSI names appear. The quiet-install-from-URL branch is the noisiest; scope it to non-managed hosts or drop it if software deployment uses URL installs.

• 🔒 Windows Script Host Running JavaScript from Download, Temp, Mail or Archive Paths, and Oversized or Known-Hash JS Dropped · unlock with TL Creds
• 🔒 Scheduled Task and Autorun Persistence from Latrodectus Loader Processes · unlock with TL Creds
• 🔒 Network Connections to Latrodectus WebDAV and Script Delivery Infrastructure · unlock with TL Creds
• 🔒 WebDAV Network Drive Mapping via net use or msiexec UNC Install (Latrodectus MSI Staging) · unlock with TL Creds
• 🔒 Process and System Discovery or Command Shell Spawned by rundll32 (Latrodectus DLL Loader Behaviour) · unlock with TL Creds
• 🔒 DNS Resolution of Known Latrodectus C2, Update and Payload Delivery Domains · unlock with TL Creds
• 🔒 Latrodectus Persistence: Autorun Registry Value or Scheduled Task Running rundll32 / User-Writable Path · unlock with TL Creds
• 🔒 Latrodectus HTTPS C2 Registration POST to /live/ URI and Payload Staging via /files/ · unlock with TL Creds

Indicators of compromise for Latrodectus junk-comment loader

As of 2026-10-30, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-4805.

Sample indicators (3 of 25)

• IP address: 5.252.21[.]207
• Domain: sokingscrosshotel[.]com
• File hash: 71fb25cc4c05ce9dd94614ed781d85a50dccf69042521abc6782d48df85e6de9

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

How Latrodectus junk-comment loader works

Latrodectus (also tracked as BlackWidow, IceNova, Lotus) is a downloader that Proofpoint first observed in email campaigns in late November 2023 and assessed as a new malware family likely written by the IcedID developers. It was first distributed by TA577 and from mid-January 2024 primarily by TA578. The sample analyzed by Embee Research (published 2024-03-26) was uploaded to MalwareBazaar by pr0xylife and is the JavaScript stage of a chain that ends with an MSI payload named upd.msi.

Stage 1 is a roughly 845KB JavaScript file containing a very large number of junk comments generated from wordlists, with the real malicious code scattered among them. Stage 2 is self-referencing: the script reads its own file contents, extracts the lines that begin with four forward slashes (////), and executes the extracted code through the WScript object. Embee Research deobfuscated the layers with regex-based extraction in CyberChef and a regex-capable text editor.

Stage 3 is VBScript-style code run via WMI. It uses the WScript.Network object to map a network drive to sokingscrosshotel.com, runs upd.msi with msiexec.exe (spawned under wmiprvse.exe via WMI, which breaks the obvious parent-child process chain), then removes the drive mapping. Proofpoint separately reports the URL http://sokingscrosshotel.com/share/upd.msi as a WebDAV payload URL in a campaign observed on 2024-03-18, matching this sample's infrastructure. Proofpoint describes the same MSI-over-WebDAV delivery pattern for gsm.msi, escape.msi and cisa.msi in February and March 2024.

The payload is the Latrodectus DLL loader. Per Proofpoint it registers with a C2 over HTTPS using POST requests whose parameters are RC4-encrypted (key 12345) and base64-encoded, with the URI path /live/. It supports commands for file and process enumeration, executing EXE and DLL files, running commands via cmd.exe, self-update, and downloading IcedID (bp.dat). It checks the environment (minimum process count, 64-bit, valid MAC address, debugger) and uses a mutex to prevent reinfection. LevelBlue reports persistence through autorun registry keys and scheduled tasks and runtime API resolution via PEB walking and CRC32.

Attribution of this specific sample is not stated by Embee Research. The sokingscrosshotel.com URL appears in a Proofpoint campaign timeline during the period when TA578 was the primary Latrodectus operator, so attribution here is low confidence. Severity is an analyst assessment and not stated by the source. No CVE is associated with this threat. A BeaconBeagle domain search for sokingscrosshotel.com returned no results.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1202 Indirect Command Execution; T1218.007 Msiexec; T1497.001 System Checks

Execution

T1047 Windows Management Instrumentation; T1059.005 Visual Basic; T1059.007 JavaScript; T1204.002 Malicious File

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Discovery

T1057 Process Discovery

Command and Control

T1071.001 Web Protocols; T1573.001 Symmetric Cryptography

Initial Access

T1566.002 Spearphishing Link

Remediation for Latrodectus junk-comment loader

Immediate actions

• Block sokingscrosshotel.com and the other Latrodectus WebDAV/C2 indicators at DNS, proxy and firewall
• Hunt for wscript.exe or cscript.exe executing very large .js files, and for msiexec.exe spawned by wmiprvse.exe
• Hunt for net use or WScript.Network drive mappings to external hosts followed by msiexec.exe /i against a mapped path or WebDAV URL

Workarounds

• Restrict msiexec.exe installation from remote or non-managed sources with AppLocker or WDAC where feasible
• Disable Windows Script Host where it is not needed

Longer-term hardening

• Associate .js and .jse files with Notepad or block their execution from user-writable paths and downloads
• Restrict outbound WebDAV (HTTP/80 to external hosts from the WebClient service) and SMB where not required
• Deploy EDR with behavioral detection for script-to-WMI-to-msiexec chains
• Train users on email thread-hijacking and fake contact-form lures

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows systems with Windows Script Host and Windows Installer enabled

Timeline of Latrodectus junk-comment loader

• 2023-11-28 Proofpoint observes locked-ioc-21 in three TA577 email campaigns in November 2023; the last was on 28 November 2023
• 2023-12-14 TA578 first observed using locked-ioc-21, via a DanaBot infection
• 2024-02-20 Copyright-infringement contact-form lures deliver JavaScript from Google Firebase that runs an MSI hosted on a WebDAV share (locked-ioc-25)
• 2024-03-04 WebDAV MSI payload locked-ioc-23 observed at locked-ioc-20
• 2024-03-18 Proofpoint lists locked-ioc-2 as a WebDAV MSI payload URL for this date
• 2024-03-26 Embee Research publishes deobfuscation analysis of the junk-comment, self-referencing locked-ioc-21 JavaScript loader uploaded to MalwareBazaar by pr0xylife

Sources cited for Latrodectus junk-comment loader

• Latrodectus Malware Analysis - Decoding Obfuscated Malware By Removing Junk Comments embeeresearch.io · Research · 2024-03-26
• Proofpoint: Latrodectus - This Spider Bytes Like Ice Proofpoint · Vendor report
• LevelBlue: Analyzing Latrodectus - The New Face of Malware Loaders levelblue.com · Vendor report
• MalwareBazaar sample 71fb25cc4c05ce9dd94614ed781d85a50dccf69042521abc6782d48df85e6de9 bazaar.abuse.ch · Research
• BleepingComputer: New Latrodectus malware replaces IcedID in network breaches BleepingComputer · News
• Infosecurity Magazine: New Malware Latrodectus Linked to IcedID infosecurity-magazine.com · News
• The Hacker News: Watch Out for Latrodectus The Hacker News · News
• CSO Online: Meet Latrodectus, initial access brokers' new favorite malware loader csoonline.com · News

More in malware

• Corium: ClickFix Distribution and Campaign-Management Panel Advertised on Exploit.IN
• CastleLoader debuts in Red Canary top 10: paste-and-run delivery of NetSupport Manager, CastleRAT and .NET infostealer; KongTuke surge
• Recorteiro: Rust banking trojan with 'Recort' screen-hole overlay fraud distributed via fake EnergiaLusa electricity bills in Portugal
• SectopRAT delivered via GPULoader and VMLoader (GPU-based decryption, EtherHiding C2, FakeGuard AitM)
• NotC2: Proof-of-Concept Framework Abuses Amazon Bedrock, SQS, Lambda and SNS as Cloud Command-and-Control

More from TA578 - G1038

• Latrodectus Loader: Three-Stage JScript/VBScript Obfuscation Delivers WMI/msiexec MSI Payload (sokingscrosshotel[.]com)
• Latrodectus Phishing Campaign Delivering LummaStealer via 302-Redirect Domain Infrastructure (lufyfeo[.]org, 36-domain cluster)
• Spamhaus H2 2025 Botnet Threat Update: VenomRAT Developer Arrest, Latrodectus Resurgence, and Shift Toward Domain-Based C2 Amid Bulletproof Hosting Crackdowns

Previous and next in malware

• Malware Infrastructure Reuse Tracked via Passive DNS Pivoting (LokiBot, Bagle, Xworm, Remcos) Previous report
• NetSupport Loader multi-stage obfuscated PowerShell chain (decimal array, AES-ECB, GZIP) deobfuscated with CyberChef Next report