# Latrodectus Loader – Script Obfuscation via Junk Comments and Self-Referencing Code (upd.msi sample)

> Embee Research analyzed a Latrodectus loader JavaScript (845KB) hidden among wordlist-generated junk comments, which reads its own file to extract lines prefixed with four slashes and executes them via WScript. The final stage uses WMI to map a network drive to sokingscrosshotel.com and run upd.msi through msiexec.exe.

- **Published:** 2026-10-30T07:04:52Z
- **Last reviewed:** 2026-10-30T07:04:52Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4805
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4805.png
- **ID:** TL-2026-4805
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** TA578 - G1038
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)

## Description

Latrodectus (also tracked as BlackWidow, IceNova, Lotus) is a downloader that Proofpoint first observed in email campaigns in late November 2023 and assessed as a new malware family likely written by the IcedID developers. It was first distributed by TA577 and from mid-January 2024 primarily by TA578. The sample analyzed by Embee Research (published 2024-03-26) was uploaded to MalwareBazaar by pr0xylife and is the JavaScript stage of a chain that ends with an MSI payload named upd.msi.

Stage 1 is a roughly 845KB JavaScript file containing a very large number of junk comments generated from wordlists, with the real malicious code scattered among them. Stage 2 is self-referencing: the script reads its own file contents, extracts the lines that begin with four forward slashes (////), and executes the extracted code through the WScript object. Embee Research deobfuscated the layers with regex-based extraction in CyberChef and a regex-capable text editor.

Stage 3 is VBScript-style code run via WMI. It uses the WScript.Network object to map a network drive to sokingscrosshotel.com, runs upd.msi with msiexec.exe (spawned under wmiprvse.exe via WMI, which breaks the obvious parent-child process chain), then removes the drive mapping. Proofpoint separately reports the URL http://sokingscrosshotel.com/share/upd.msi as a WebDAV payload URL in a campaign observed on 2024-03-18, matching this sample's infrastructure. Proofpoint describes the same MSI-over-WebDAV delivery pattern for gsm.msi, escape.msi and cisa.msi in February and March 2024.

The payload is the Latrodectus DLL loader. Per Proofpoint it registers with a C2 over HTTPS using POST requests whose parameters are RC4-encrypted (key 12345) and base64-encoded, with the URI path /live/. It supports commands for file and process enumeration, executing EXE and DLL files, running commands via cmd.exe, self-update, and downloading IcedID (bp.dat). It checks the environment (minimum process count, 64-bit, valid MAC address, debugger) and uses a mutex to prevent reinfection. LevelBlue reports persistence through autorun registry keys and scheduled tasks and runtime API resolution via PEB walking and CRC32.

Attribution of this specific sample is not stated by Embee Research. The sokingscrosshotel.com URL appears in a Proofpoint campaign timeline during the period when TA578 was the primary Latrodectus operator, so attribution here is low confidence. Severity is an analyst assessment and not stated by the source. No CVE is associated with this threat. A BeaconBeagle domain search for sokingscrosshotel.com returned no results.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.005 Visual Basic
- T1047 Windows Management Instrumentation
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1218.007 Msiexec
- T1202 Indirect Command Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1057 Process Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Latrodectus MSI Payload Execution via msiexec Spawned by WmiPrvSE (upd.msi WebDAV)** (`TL-2026-4805-SPL-001`)

Detects the Latrodectus stage-3 pattern from the Embee Research upd.msi sample (TL-2026-4805): msiexec.exe launched under wmiprvse.exe via WMI (the VBScript-style stage breaks the obvious script-to-msiexec parent-child chain), msiexec installing a known Latrodectus WebDAV MSI (upd.msi, gsm.msi, escape.msi, cisa.msi) or fetching from sokingscrosshotel.com or a DavWWWRoot / @80 WebDAV path, or msiexec doing a quiet install straight from a URL. Behaviour-first: the WMI parent is the primary signal and does not depend on the IOC list staying current.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1218.007, T1047, T1202, T1105, T1059.005
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
( (Image="*\\msiexec.exe" ParentImage="*\\wmiprvse.exe")
OR (Image="*\\msiexec.exe" (CommandLine="*upd.msi*" OR CommandLine="*gsm.msi*" OR CommandLine="*escape.msi*" OR CommandLine="*cisa.msi*" OR CommandLine="*sokingscrosshotel.com*" OR CommandLine="*DavWWWRoot*" OR CommandLine="*@80\\*"))
OR (Image="*\\msiexec.exe" CommandLine="*://*" (CommandLine="* /i*" OR CommandLine="* -i*") (CommandLine="* /q*" OR CommandLine="* -q*")) )
| eval detection_branch=case(match(lower(ParentImage),"wmiprvse\\.exe$"),"msiexec_spawned_by_wmiprvse", match(CommandLine,"(?i)(upd|gsm|escape|cisa)\\.msi|sokingscrosshotel\\.com|DavWWWRoot|@80"),"known_latrodectus_webdav_msi_or_remote_path", true(),"msiexec_quiet_install_from_url")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by host User ParentImage Image detection_branch
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "msiexec.exe"
| where InitiatingProcessFileName =~ "wmiprvse.exe"
    or ProcessCommandLine has_any ("upd.msi", "gsm.msi", "escape.msi", "cisa.msi", "sokingscrosshotel.com", "DavWWWRoot", "@80\\")
    or (ProcessCommandLine has "://" and ProcessCommandLine has_any (" /i", " -i") and ProcessCommandLine has_any (" /q", " -q"))
| extend DetectionBranch = case(InitiatingProcessFileName =~ "wmiprvse.exe", "msiexec_spawned_by_wmiprvse", ProcessCommandLine has_any ("upd.msi", "gsm.msi", "escape.msi", "cisa.msi", "sokingscrosshotel.com", "DavWWWRoot", "@80\\"), "known_latrodectus_webdav_msi_or_remote_path", "msiexec_quiet_install_from_url")
| project Timestamp, DeviceName, AccountName, DetectionBranch, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| order by Timestamp desc
```

### Sigma

```yaml
title: Latrodectus MSI Execution via msiexec Spawned by WmiPrvSE or Known WebDAV MSI
id: 3f6b1c52-8d4e-4a17-9b2c-5e0a71d4c801
status: experimental
description: Detects msiexec.exe spawned by wmiprvse.exe (WMI-based execution used by the Latrodectus JavaScript loader to hide the parent chain), msiexec installing known Latrodectus WebDAV MSI payloads (upd.msi, gsm.msi, escape.msi, cisa.msi) or from sokingscrosshotel.com / WebDAV paths, and quiet msiexec installs directly from a URL.
references:
    - https://www.embeeresearch.io/latrodectus-script-deobfuscation/
    - https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice
    - https://www.levelblue.com/blogs/levelblue-blog/analyzing-latrodectus-the-new-face-of-malware-loaders
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-30
tags:
    - attack.defense-evasion
    - attack.execution
    - attack.command-and-control
    - attack.t1218.007
    - attack.t1047
    - attack.t1202
    - attack.t1105
    - attack.t1059.005
    - attack.s1160
logsource:
    category: process_creation
    product: windows
detection:
    selection_wmi_parent:
        Image|endswith: '\msiexec.exe'
        ParentImage|endswith: '\wmiprvse.exe'
    selection_known_msi:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains:
            - 'upd.msi'
            - 'gsm.msi'
            - 'escape.msi'
            - 'cisa.msi'
            - 'sokingscrosshotel.com'
            - 'DavWWWRoot'
            - '@80\'
    selection_url_img:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains: '://'
    selection_url_install:
        CommandLine|contains:
            - ' /i'
            - ' -i'
    selection_url_quiet:
        CommandLine|contains:
            - ' /q'
            - ' -q'
    condition: selection_wmi_parent or selection_known_msi or (selection_url_img and selection_url_install and selection_url_quiet)
falsepositives:
    - Software deployment or inventory tooling that launches Windows Installer through WMI (for example Win32_Product.Install or SCCM-style remote installs)
    - Administrators silently installing internally hosted MSI packages from an HTTP URL
level: high

```

**Known false positives:**

- Legitimate software deployment or patching tools that invoke msiexec through WMI (Win32_Product.Install, remote install scripts)
- Administrators installing internally hosted MSI packages from a WebDAV, @80 or HTTP share

**Tuning notes:** Allowlist known deployment servers and service accounts in the User / ParentCommandLine fields, and baseline msiexec children of wmiprvse.exe for 14 days before alerting. Keep the WMI-parent branch always on; the filename and domain branch is IOC-based and should be refreshed as new Latrodectus MSI names appear. The quiet-install-from-URL branch is the noisiest; scope it to non-managed hosts or drop it if software deployment uses URL installs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Windows Script Host Running JavaScript from Download, Temp, Mail or Archive Paths, and Oversized or Known-Hash JS Dropped (locked: unlock with TL Creds)
- Scheduled Task and Autorun Persistence from Latrodectus Loader Processes (locked: unlock with TL Creds)
- Network Connections to Latrodectus WebDAV and Script Delivery Infrastructure (locked: unlock with TL Creds)
- WebDAV Network Drive Mapping via net use or msiexec UNC Install (Latrodectus MSI Staging) (locked: unlock with TL Creds)
- Process and System Discovery or Command Shell Spawned by rundll32 (Latrodectus DLL Loader Behaviour) (locked: unlock with TL Creds)
- DNS Resolution of Known Latrodectus C2, Update and Payload Delivery Domains (locked: unlock with TL Creds)
- Latrodectus Persistence: Autorun Registry Value or Scheduled Task Running rundll32 / User-Writable Path (locked: unlock with TL Creds)
- Latrodectus HTTPS C2 Registration POST to /live/ URI and Payload Staging via /files/ (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `5.252.21[.]207`
- Domain: `sokingscrosshotel[.]com`
- File hash: `71fb25cc4c05ce9dd94614ed781d85a50dccf69042521abc6782d48df85e6de9`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Latrodectus Malware Analysis - Decoding Obfuscated Malware By Removing Junk Comments](https://www.embeeresearch.io/latrodectus-script-deobfuscation/)
- [Proofpoint: Latrodectus - This Spider Bytes Like Ice](https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice)
- [LevelBlue: Analyzing Latrodectus - The New Face of Malware Loaders](https://www.levelblue.com/blogs/levelblue-blog/analyzing-latrodectus-the-new-face-of-malware-loaders)
- [BleepingComputer: New Latrodectus malware replaces IcedID in network breaches](https://www.bleepingcomputer.com/news/security/new-latrodectus-malware-replaces-icedid-in-network-breaches/)
- [Infosecurity Magazine: New Malware Latrodectus Linked to IcedID](https://www.infosecurity-magazine.com/news/malware-latrodectus-linked-icedid/)
- [The Hacker News: Watch Out for Latrodectus](https://thehackernews.com/2024/04/watch-out-for-latrodectus-this-malware.html)
- [CSO Online: Meet Latrodectus, initial access brokers' new favorite malware loader](https://www.csoonline.com/article/3570919/meet-latrodectus-initial-access-brokers-new-favorite-malware-loader.html)
- [MalwareBazaar sample 71fb25cc4c05ce9dd94614ed781d85a50dccf69042521abc6782d48df85e6de9](https://bazaar.abuse.ch/sample/71fb25cc4c05ce9dd94614ed781d85a50dccf69042521abc6782d48df85e6de9/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4805