Latrodectus Backdoor IOCs - Part 6

Unidentified 111 (он же: Latrodectus, BLACKWIDOW, Latrodectus, Lotus) - впервые обнаруженный в октябре 2023 года BLACKWIDOW представляет собой бэкдор, написанный на языке C, который взаимодействует по протоколу HTTP с помощью запросов, зашифрованных с помощью RC4. Вредонос способен выполнять команды обнаружения, запрашивать информацию о машине жертвы, обновлять себя, а также загружать и выполнять EXE, DLL или шелл-код. Предполагается, что вредонос был разработан LUNAR SPIDER, создателями вредоносной программы IcedID (она же BokBot).

Indicators of Compromise

IPv4 Port Combinations

• 144.76.231.240:10000

URLs

• http://146.19.106.236/neo.msi
• http://161.97.170.81/ceptics/wp-content/plugins/share-private-fls/shared
• http://185.219.220.149/bim.msi
• http://45.95.11.217/ad.msi
• http://antvietnam.com/wp-content/plugins/user-private-files/shared/
• http://azucania.com.ar/wp-content/plugins/share-private-fls/shared
• http://besparta.com/markaworks/wp-content/plugins/share-private-fls/shared
• http://bissecci.org/wp-content/plugins/user-private-files/shared/
• http://cbg.divineunveil.com/wp-content/plugins/user-private-files/shared/
• http://dsengineer.in/wp-content/plugins/share-private-fls/shared
• http://especial.cargasproprias.org/wp-content/plugins/share-private-fls/shared
• http://konsaltakuatorial.com/indigo/wp-content/plugins/user-private-files/shared/
• http://newsmedia247.site/wp-content/plugins/user-private-files/shared/
• http://onemascot.com/wp-content/plugins/share-private-fls/shared
• http://phatthanhnghia.com/wp-content/plugins/user-private-files/shared/
• http://phs124168.com/wp-content/plugins/user-private-files/shared/
• http://tutycholid.com/tangerang/wp-content/plugins/user-private-files/shared/
• http://ugandainarabic.com/wp-content/plugins/user-private-files/shared/
• http://vegasnights.co.za/wp/wp-content/plugins/user-private-files/shared/
• http://vridhifashions.com/wp-content/plugins/share-private-fls/shared
• http://www.loja.consolata.pt/news/wp-content/plugins/share-private-fls/shared
• http://www.skytechtraders.com/wp-content/plugins/share-private-fls/shared
• http://www.websitedesigningindia.biz/projects/visioncrystal/wp-content/plugins/user-private-files/shared/
• https://2mo.com/wp-content/plugins/share-private-files/shared/
• https://790wolseleymanagement.com/wp-content/plugins/share-private-fls/shared
• https://99homes.co/wp-content/plugins/share-private-fls/shared
• https://aavishkaar-palampur.org/wp-content/plugins/share-private-fls/shared
• https://abd.com.tr/wp-content/plugins/share-private-fls/shared
• https://abhitaak.com/wp-content/plugins/share-private-fls/shared
• https://alealealpargatas.com/wp-content/plugins/share-private-fls/shared
• https://alsiga.com/wp-content/plugins/share-private-fls/shared
• https://antvietnam.com/wp-content/plugins/user-private-files/shared/
• https://ariesjagnivas.com/wp-content/plugins/share-private-fls/shared
• https://arrivingback.org/security_check/
• https://aryanlogisticpune.in/wp-content/plugins/share-private-fls/shared
• https://audio.daiphucminh.vn/wp-content/plugins/user-private-files/shared/
• https://bar.dosdevelopers.com/wp-content/plugins/share-private-fls/shared
• https://bigwing.algoitsolutions.co.uk/wp-content/plugins/share-private-files/shared/
• https://bissecci.org/wp-content/plugins/user-private-files/shared/
• https://blog.multitamamedia.com/wp-content/plugins/share-private-fls/shared
• https://brikule.cz/wp-content/plugins/share-private-fls/shared/?check=true
• https://camerabaoha.com/wp-content/plugins/share-private-fls/shared/?check=true
• https://cbg.divineunveil.com/wp-content/plugins/user-private-files/shared/
• https://christianbookindia.com/wp-content/plugins/share-private-fls/shared
• https://compresoresdetornillo.com.pe/wp-content/plugins/share-private-fls/shared
• https://contractnerds.com/wp-content/plugins/share-private-fls/shared
• https://coronacreatives.com/wp-content/plugins/share-private-fls/shared
• https://cricrapid.com/wp-content/plugins/share-private-fls/shared
• https://cricrapid.com/wp-content/plugins/share-private-fls/shared/
• https://cytotecsolutions.com/wp-content/plugins/share-private-fls/shared
• https://deadvogados.com/wp-content/plugins/share-private-fls/shared
• https://dealerpertamini.com/wp-content/plugins/share-private-fls/shared
• https://delight.mv/wp-content/plugins/share-private-fls/shared
• https://devaccrocs.allianceconsultants.net/wp-content/plugins/user-private-files/shared/
• https://dhlawfirm.site/wp-content/plugins/share-private-fls/shared
• https://dickypommini.com/wp-content/plugins/share-private-fls/shared
• https://didacweb.xyz/intuitionbycg/wp-content/plugins/share-private-fls/shared
• https://digitalssystems.com/wp-content/plugins/share-private-fls/shared
• https://dimozti1.org/security_check/
• https://direitopositivado.com.br/site/wp-content/plugins/user-private-files/shared/
• https://divifar.com/wp-content/plugins/user-private-files/shared/
• https://djibg.eu/wp-content/plugins/share-private-fls/shared
• https://dolasimuka.com/wp-content/plugins/share-private-fls/shared
• https://doulosarts.com.br/wp-content/plugins/share-private-fls/shared
• https://dpmpommini.com/wp-content/plugins/share-private-fls/shared
• https://ebs-company.xyz/wp-content/plugins/share-private-fls/shared
• https://eco-villas.com/wp-content/plugins/share-private-files/shared/
• https://elitpuro1.com/wp-content/plugins/share-private-fls/shared
• https://equranteacher.net/wp-content/plugins/share-private-fls/shared
• https://espaciodiseno.es/wp-content/plugins/share-private-fls/shared
• https://friendswekeep.vecloffy.co.za/vecloffy/wp-content/plugins/share-private-fls/shared
• https://gaming-gears.com/wp-content/plugins/share-private-fls/shared
• https://gifdemo.com/gps_sunum/wp-content/plugins/share-private-fls/shared
• https://gifdemo.com/mertmetdemo/wp-content/plugins/share-private-fls/shared
• https://goasoftwarecompany.com/Doxa_Organic/wp-content/plugins/share-private-fls/shared
• https://grizmotras.com/live
• https://grupobudeguer.com/wp-content/plugins/share-private-fls/shared
• https://guidespharma.com/wp-content/plugins/share-private-fls/shared
• https://hadjer.boutique/wp-content/plugins/share-private-fls/shared
• https://hakelectromechanical.com/wp-content/plugins/share-private-fls/shared
• https://hawaiismartshopper.com/wp-content/plugins/share-private-fls/shared
• https://himeraveteriner.com/himera-v1/wp-content/plugins/share-private-fls/shared
• https://hunarghar.org.pk/wp-content/plugins/share-private-fls/shared
• https://hvg.si/wp-content/plugins/share-private-fls/shared
• https://i.thietke.in/wp-content/plugins/user-private-files/shared/
• https://ideanet.co.in/wp-content/plugins/user-private-files/shared/
• https://ideosphere.in/wp-content/plugins/user-private-files/shared/
• https://infojobone.com/wp-content/plugins/share-private-fls/shared
• https://iswpcreator.com/networkconnect/wp-content/plugins/user-private-files/shared/
• https://ivtmarkets.com/wp-content/plugins/share-private-fls/shared
• https://jarinamaers.shop/live/
• https://jasarenovasibangunrumahmalang.com/wp-content/plugins/share-private-fls/shared
• https://jms.edu.np/wp-content/plugins/share-private-fls/shared
• https://jobsportal360.com/wp-content/plugins/share-private-fls/shared
• https://joshiwater.com/wp-content/plugins/share-private-fls/shared
• https://karamelitses.gr/wp-content/plugins/share-private-fls/shared
• https://kartsiotis.net/wp-content/plugins/share-private-fls/shared
• https://ladakhescapades.com/wp-content/plugins/share-private-fls/shared
• https://lew-hoad.com/wp-content/plugins/share-private-fls/shared
• https://lle.uz/wp-content/plugins/share-private-fls/shared
• https://lurningbuff.com/wp-content/plugins/share-private-fls/shared
• https://mahmoud-radwan.com/wp-content/plugins/share-private-fls/shared
• https://manbaulhudaasia.aliyy.my/wp-content/plugins/user-private-files/shared/
• https://manuurulwaahid.sch.id/wp-content/plugins/share-private-fls/shared
• https://mathsclass.vn/wp-content/plugins/share-private-fls/shared/?check=true
• https://mbdashcam.com/wp-content/plugins/share-private-fls/shared
• https://meletesergon.gr/wp-content/plugins/share-private-fls/shared
• https://metrobasket.in/wp-content/plugins/share-private-files/shared/
• https://milkganache.com.br/chocolate/wp-content/plugins/user-private-files/shared/
• https://mining.jaguarmall.in/code/core/database/press/wp-content/plugins/share-private-fls/shared
• https://mixstore.com.mx/wp-content/plugins/share-private-fls/shared
• https://mozkraty.org/wp-content/plugins/share-private-fls/shared
• https://mundo-felpa.es/wp-content/plugins/share-private-fls/shared
• https://mydesinger.com/wp-content/plugins/share-private-fls/shared
• https://myquickandeasy.com/wp-content/plugins/share-private-fls/shared
• https://narutoanimes.com/wp-content/plugins/share-private-fls/shared
• https://new.botellaflaske.com/wp-content/plugins/share-private-fls/shared
• https://newsmedia247.site/wp-content/plugins/user-private-files/shared/
• https://nickicecream.gr/wp-content/plugins/share-private-fls/shared
• https://nlqbgkl5.org/security_check/
• https://nobledeals.co.ke/wp-content/plugins/share-private-fls/shared
• https://nyklawyer.com/wp-content/plugins/share-private-fls/shared
• https://panakalresidence.com/wp-content/plugins/share-private-fls/shared
• https://parthait.com/wp-content/plugins/share-private-fls/shared
• https://patriziamarazzi.com/wp-content/plugins/share-private-fls/shared
• https://pavicomsa.com/wp-content/plugins/share-private-fls/shared
• https://penjualanpommini.com/wp-content/plugins/share-private-fls/shared
• https://pewwhranet.com/live
• https://pgdm.my/wp-content/plugins/user-private-files/shared/
• https://phs124168.com/wp-content/plugins/user-private-files/shared/
• https://ponyevent.vn/wp-content/plugins/share-private-fls/shared
• https://portstanleycalipso.com/wp-content/plugins/share-private-fls/shared
• https://ptcmbp.com/wp-content/plugins/share-private-fls/shared
• https://puntobar.cl/wp-content/plugins/share-private-fls/shared
• https://quotesparade.com/wp-content/plugins/user-private-files/shared/
• https://reyadtours.com/wp-content/plugins/user-private-files/shared/
• https://rjjewelpk.com/wp-content/plugins/share-private-files/shared/
• https://sanvikevents.com/wp-content/plugins/share-private-fls/shared
• https://saveutilitybills.com/wp-content/plugins/share-private-files/shared/
• https://seraphyaromatherapy.com/wp-content/plugins/user-private-files/shared
• https://shredderindia.com/wp-content/plugins/share-private-fls/shared/?check=true
• https://slot.hoki66.com/wp-content/plugins/share-private-fls/shared
• https://smartoptiontrade.online/account/wp-content/plugins/share-private-fls/shared
• https://sociallysnap.com/wp-content/plugins/share-private-fls/shared
• https://startmast.shop/live/
• https://stgmountainair.wpengine.com/wp-content/plugins/user-private-files/shared/
• https://streetpulsedev.wpengine.com/wp-content/plugins/share-private-fls/shared
• https://subwaymenu.uk/wp-content/plugins/share-private-fls/shared
• https://summerlanddogtraining.com/wp-content/plugins/share-private-fls/shared
• https://svango.com/wp-content/plugins/share-private-fls/shared
• https://taifateule.com/wp-content/plugins/user-private-files/shared/
• https://take3llcphotobooth.com/TakeNew/wp-content/plugins/share-private-fls/shared
• https://templarstore.com/wp-content/plugins/share-private-fls/shared
• https://template.majestic-corporation.com/wp-content/plugins/share-private-fls/shared
• https://testing.vidharm.com/wp-content/plugins/share-private-fls/shared
• https://thayhoicoffee.com/wp-content/plugins/user-private-files/shared/
• https://thecocopacific.com/wp-content/plugins/share-private-fls/shared
• https://themetafounders.com/web/chris-csp/wp-content/plugins/share-private-fls/shared
• https://themusclemob.themetafounders.com/wp-content/plugins/share-private-fls/shared
• https://things101dev.wpengine.com/wp-content/plugins/share-private-fls/shared
• https://tirtaningnusantara.com/wp-content/plugins/share-private-fls/shared
• https://tomitakaengenharia.com.br/wp-content/plugins/share-private-fls/shared
• https://toptradingoption.com/account/wp-content/plugins/share-private-fls/shared
• https://tour.culturetoursja.com/wp-content/plugins/share-private-fls/shared
• https://turkishmarinesurvey.com/wp-content/plugins/share-private-fls/shared
• https://ugandainarabic.com/wp-content/plugins/user-private-files/shared/
• https://upr.lk/wp-content/plugins/user-private-files/shared/
• https://vcfiling.pk/wp-content/plugins/share-private-fls/shared
• https://vhs.decospaacloud.in/wp-content/plugins/share-private-fls/shared
• https://vilape.online/wp-content/plugins/share-private-fls/shared
• https://vincecomfort.com/social/wp-content/plugins/share-private-fls/shared
• https://vitrine.izaragency.com/Epicure-Traiteur/wp-content/plugins/user-private-files/shared/
• https://vitrine.izaragency.com/model-2/wp-content/plugins/user-private-files/shared/
• https://vnfreetourguides.com/wp-content/plugins/share-private-fls/shared
• https://vridhifashions.com/wp-content/plugins/share-private-fls/shared
• https://warriorstaging.wpengine.com/wp-content/plugins/share-private-fls/shared
• https://wecancity.org/ahmed/wp-content/plugins/share-private-fls/shared
• https://wisdomlawacademy.com/wp-content/plugins/share-private-fls/shared
• https://wlfw.themetafounders.com/wp-content/plugins/share-private-fls/shared
• https://wrankaget.site/live/
• https://www.bodegabudeguer.com/wp-content/plugins/share-private-fls/shared
• https://www.crickrocket.com/wp-content/plugins/share-private-fls/shared
• https://www.darkknight-media.com/tasawer/wp-content/plugins/share-private-fls/shared
• https://www.eurotravel.com.gr/wp-content/plugins/share-private-fls/shared
• https://www.ferentino.org/wp-content/plugins/share-private-fls/shared
• https://www.fit4life.es/wp-content/plugins/share-private-fls/shared
• https://www.hawaiiislandmidweek.com/wp-content/plugins/share-private-fls/shared
• https://www.kathatours.com/wp-content/plugins/share-private-fls/shared
• https://www.loja.consolata.pt/news/wp-content/plugins/share-private-fls/shared
• https://www.meilinhotels.com/wp-content/plugins/share-private-fls/shared
• https://www.pansy-dz.com/wp-content/plugins/user-private-files/shared/
• https://www.pujamosporti.com/wp-content/plugins/share-private-files/shared/
• https://www.qi-code.com/wp-content/plugins/share-private-fls/shared
• https://www.tajimateknikservis.com/wp-content/plugins/share-private-fls/shared
• https://www.tatuhirdavat.com/wp-content/plugins/share-private-fls/shared
• https://www.topinoxsenegal.com/wp-content/plugins/share-private-fls/shared
• https://www.valex-dz.com/wp-content/plugins/share-private-fls/shared
• https://www.vccg.com.au/wp-content/plugins/share-private-fls/shared
• https://www.wonderwritings.com/wp-content/plugins/share-private-fls/shared
• https://yahyacarpet.com/wp-content/plugins/user-private-files/shared/
• https://youpickcarepackages.com/wp-content/plugins/share-private-fls/shared
• https://zatracon.com/wp-content/plugins/share-private-fls/shared
• https://zeemark.in/wp-content/plugins/share-private-fls/shared
• https://zk1construction.com/wp-content/plugins/share-private-fls/shared

MD5

• 0dd2248957978e9676538919fbeadac3
• 495d3ad9014fcd04925dc82f1604bc64
• d9607ce7e345a2b77545ca25887db614

SHA256

• 156c0afc01a5e346b95ebdb60cea9b7046ad7a61199cd63d6ad0f4ae32a576ac
• 1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11
• 4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe
• 4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a
• 53e65d071870f127bc6bf6c8e8ddfd131558153513976744ee7460eeb766d081
• 8041a15e27c785f2adcce9e8c643f5cc619b52e50cd36ff043d13c4089ce1cad
• a9fa025fe912c8ad5e6566c675e045732c4d89f4187bfd94c4e916dd9fe25417
• bb9203ca1305e47a2ec1443a640efcd5e2c7d11223184639729673579e12967e
• deb2c73fc314f347e01b90650dd116b1fea372d0774ab19257be560aeef03e23
• fcb578b52a686ed9b202295cbae84e20e0533caa4f8b6fffce6ee9f74ce33268