Threat video1:00
Latrodectus Junk-Comment JS Loader: Detection & IOCs
Latrodectus hides its JavaScript among junk comments, then runs an MSI via msiexec. 25 IOCs and 9 detection rules, including a free Splunk SPL rule.
Read the full threat intel for Latrodectus Junk-Comment JS Loader: Detection & IOCs →
Chapters
- 0:00The hookLoader hides in about 845KB code
- 0:04The storyCode hidden in junk comments
- 0:10Attack pathVictim downloads malicious JavaScript
- 0:24AttributionAttributed to TA578 - G1038.
- 0:31Indicators of compromise24 indicators to hunt: 6 IPs, 11 domains and 2 URLs, and more.
- 0:38MITRE ATT&CK techniques15 ATT&CK techniques, from initial access to command and control.
- 0:43Remediation3 steps now: Block sokingscrosshotel[.]com and the other Latrodectus.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Loader hides in about 845KB code
0:05Code hidden in junk comments
0:06MSI installer runs
0:10Victim downloads malicious JavaScript
0:13Script reads itself, extracts hidden code
0:16Maps WebDAV drive, runs MSI loader
0:19Registers with C2 over HTTPS
0:25Attributed to TA578 - G1038. Confidence: low.
0:3224 indicators to hunt: 6 IPs, 11 domains and 2 URLs, and more.
0:3915 ATT&CK techniques, from initial access to command and control.
0:443 steps now: Block sokingscrosshotel[.]com and the other Latrodectus.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.