Latrodectus (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.latrodectus (Back to overview)

Latrodectus

aka: BLACKWIDOW, IceNova, Latrodectus, Lotus

VTCollection

First discovered in October 2023, BLACKWIDOW is a backdoor written in C that communicates over HTTP using RC4 encrypted requests. The malware has the capability to execute discovery commands, query information about the victim's machine, update itself, as well as download and execute an EXE, DLL, or shellcode. The malware is believed to have been developed by LUNAR SPIDER, the creators of IcedID (aka BokBot) Malware.

References

2026-02-17 ⋅ ⋅ CERT.PL ⋅ CERT.PL
ClickFix in action: how a fake captcha can encrypt an entire company
Latrodectus Supper

2026-01-13 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update July to December 2025
Coper FluBot Joker Aisuru Mirai AsyncRAT BianLian Cobalt Strike DCRat Havoc Latrodectus PureLogs Stealer Quasar RAT Remcos Rhadamanthys Sliver ValleyRAT Venom RAT Vidar XWorm

2025-12-10 ⋅ Netresec ⋅ Erik Hjelmvik
Latrodectus BackConnect
IcedID Keyhole Latrodectus

2025-10-10 ⋅ Malcat ⋅ Renaud Tabary
Malcat scripting tutorial: deobfuscating Latrodectus
Latrodectus

2025-09-29 ⋅ The DFIR Report ⋅ The DFIR Report
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion
Brute Ratel C4 Cobalt Strike Latrodectus

2025-07-14 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update January to June 2025
Coper FluBot Hook Joker Mirai AsyncRAT BianLian BumbleBee Chaos Cobalt Strike DanaBot DCRat Havoc Latrodectus NjRAT Quasar RAT RedLine Stealer Remcos Rhadamanthys Sliver ValleyRAT WarmCookie XWorm

2025-04-03 ⋅ Microsoft ⋅ Microsoft Threat Intelligence
Threat actors leverage tax season to deploy tax-themed phishing campaigns
Brute Ratel C4 CloudEyE Latrodectus Remcos Storm-0249

2025-04-01 ⋅ Reversing Stories ⋅ Hema Loganathan
Latrodectus Malware Delivered via Telegram Bot/Chat API
Latrodectus

2025-01-10 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update July to December 2024
Coper FluBot Hook Mirai FAKEUPDATES AsyncRAT BianLian Brute Ratel C4 Cobalt Strike DanaBot DCRat Havoc Latrodectus NjRAT Quasar RAT RedLine Stealer Remcos Rhadamanthys Sliver Stealc

2024-11-18 ⋅ Proofpoint ⋅ Proofpoint Threat Research Team, Selena Larson, Tommy Madjar
Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape
AsyncRAT Brute Ratel C4 DanaBot DarkGate Latrodectus Lumma Stealer NetSupportManager RAT XWorm

2024-10-30 ⋅ EclecticIQ ⋅ EclecticIQ Threat Research Team
Inside Intelligence Center: LUNAR SPIDER Enabling Ransomware Attacks on Financial Sector with Brute Ratel C4 and Latrodectus
BlackCat Brute Ratel C4 Latrodectus

2024-10-22 ⋅ Logpoint ⋅ Swachchhanda Shrawan Poudel
Latrodectus: The Wrath of Black Widow
Latrodectus

2024-10-21 ⋅ VMRay ⋅ VMRay Labs Team
Latrodectus: A year in the making
Latrodectus

2024-10-18 ⋅ Forcepoint ⋅ Mayur Sewani
Inside the Latrodectus Malware Campaign Old School Phishing Meets Innovative Payload Delivery
Latrodectus

2024-10-08 ⋅ Trustwave ⋅ Cris Tomboc, King Orande
Pronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader
Pronsis Loader Latrodectus Lumma Stealer

2024-09-30 ⋅ OALabs ⋅ Sergei Frankoff
Latrodectus Extracting new AES encrypted strings from this RAT
Latrodectus

2024-08-29 ⋅ Netskope ⋅ Leandro Froes
Latrodectus Rapid Evolution Continues With Latest New Payload Features
Latrodectus

2024-08-29 ⋅ Hunt.io ⋅ Hunt.io
Latrodectus Malware Masquerades as AhnLab Security Software to Infect Victims
Latrodectus

2024-08-26 ⋅ Netskope ⋅ Leandro Froes
Static Unpacker for Latrodectus
Latrodectus

2024-08-08 ⋅ cyble ⋅ Cyble Research Labs
Double Trouble: Latrodectus and ACR Stealer observed spreading via Google Authenticator Phishing Site
ACR Stealer Latrodectus

2024-08-01 ⋅ Krakz ⋅ Pierre Le Bourhis
Latrodectus dropped by BR4
Brute Ratel C4 Latrodectus

2024-07-24 ⋅ Rapid7 ⋅ Rapid7
Malware Campaign Lures Users With Fake W2 Form
Latrodectus

2024-06-24 ⋅ RevEng.AI ⋅ RevEng.AI
Latrodectus Affiliate Resumes Operations Using Brute Ratel C4 Post Operation Endgame
Brute Ratel C4 Latrodectus

2024-06-17 ⋅ BitSight ⋅ João Batista
Latrodectus are you coming back
Latrodectus

2024-06-13 ⋅ Medium (@zyadlzyatsoc) ⋅ Zyad Elzyat
Inside LATRODECTUS: A Dive into Malware Tactics and Mitigation
Latrodectus

2024-05-21 ⋅ Twitter (@embee_research) ⋅ Embee_research
Tweets on decoding a Latrodectus loader
Latrodectus

2024-05-16 ⋅ ANY.RUN ⋅ ANY.RUN
Malware trend: Latrodectus
Latrodectus

2024-05-16 ⋅ Elastic ⋅ Daniel Stepanic, Samir Bousseaden
Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID
IcedID Latrodectus

2024-05-09 ⋅ 0x0d4y ⋅ 0x0d4y
[Case Study: Latrodectus] Analyzing and Implementing String Decryption Algorithms
Latrodectus

2024-05-05 ⋅ Github (VenzoV) ⋅ VenzoV
Latrodectus "littlehw"
Latrodectus

2024-04-30 ⋅ 0x0d4y ⋅ 0x0d4y
Latrodectus [IceNova] – Technical Analysis of the… New IcedID… Its Continuation… Or its Replacement?
Latrodectus

2024-04-24 ⋅ Securonix ⋅ Den Iyzvyk, Oleg Kolesnikov, Tim Peck
Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover
Cobalt Strike Latrodectus

2024-04-04 ⋅ Proofpoint ⋅ Proofpoint Threat Research Team, Team Cymru, TEAM CYMRU S2 THREAT RESEARCH
Latrodectus: This Spider Bytes Like Ice
IcedID Latrodectus

2024-04-01 ⋅ Twitter (@embee_research) ⋅ Embee_research
Passive DNS For Phishing Link Analysis - Identifying 36 Latrodectus Domains With Historical Records and 302 Redirects
Latrodectus

2024-03-25 ⋅ embeeresearch ⋅ Embee_research
Latrodectus Deobfuscation - Removal of Junk Comments and Self-Referencing Code
Latrodectus

2024-03-07 ⋅ Malware Traffic Analysis ⋅ Brad Duncan
2024-03-07 (THURSDAY): LATRODECTUS INFECTION LEADS TO LUMMA STEALER
Latrodectus Lumma Stealer

2023-12-23 ⋅ IBM ⋅ IBM
IceNova Malware Profile
Latrodectus

2023-12-08 ⋅ Twitter (@Myrtus0x0) ⋅ Myrtus 0x0
Tweet naming the family
Latrodectus

2023-12-07 ⋅ eSentire ⋅ eSentire
DanaBot's Latest Move: Deploying Latrodectus
DanaBot HijackLoader Latrodectus

2023-10-20 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Joshua Platt
IcedID gets Loaded
Latrodectus

Yara Rules

[TLP:WHITE] win_latrodectus_auto (20260917 | Detects win.latrodectus.)

rule win_latrodectus_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.latrodectus."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.latrodectus"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 89442424 8b442428 39442424 7404 33c0 eb47 }
            // n = 7, score = 6900
            //   e8????????           |                     
            //   89442424             | mov                 ecx, dword ptr [esp + 0xd0]
            //   8b442428             | dec                 eax
            //   39442424             | mov                 dword ptr [esp + 0x40], 0
            //   7404                 | mov                 edx, 0x250
            //   33c0                 | dec                 eax
            //   eb47                 | lea                 ecx, [esp + 0x90]

        $sequence_1 = { 4533c9 440fb7442470 488b542468 488b4c2440 ff15???????? 4889442448 48837c244800 }
            // n = 7, score = 6900
            //   4533c9               | mov                 ecx, dword ptr [esp + 0x20]
            //   440fb7442470         | inc                 esp
            //   488b542468           | mov                 ecx, ecx
            //   488b4c2440           | inc                 ebp
            //   ff15????????         |                     
            //   4889442448           | xor                 ecx, ecx
            //   48837c244800         | inc                 esp

        $sequence_2 = { e9???????? 48c744244000000000 ba50020000 488d8c2490000000 e8???????? 488d942490000000 488b4c2420 }
            // n = 7, score = 6900
            //   e9????????           |                     
            //   48c744244000000000     | and    eax, 0xff
            //   ba50020000           | sub                 eax, edx
            //   488d8c2490000000     | dec                 eax
            //   e8????????           |                     
            //   488d942490000000     | mov                 ecx, dword ptr [esp + 0x40]
            //   488b4c2420           | mov                 dword ptr [ecx + 0x108], eax

        $sequence_3 = { 488b4c2440 488b09 e8???????? 8b4c2420 448bc9 }
            // n = 5, score = 6900
            //   488b4c2440           | dec                 eax
            //   488b09               | mov                 ecx, dword ptr [esp + 0x40]
            //   e8????????           |                     
            //   8b4c2420             | dec                 eax
            //   448bc9               | mov                 ecx, dword ptr [ecx]

        $sequence_4 = { 488b842488000000 4889442428 488d442458 4889442420 4533c9 4533c0 33d2 }
            // n = 7, score = 6900
            //   488b842488000000     | dec                 eax
            //   4889442428           | mov                 eax, dword ptr [esp + 0x40]
            //   488d442458           | mov                 ecx, 0x64
            //   4889442420           | xor                 edx, edx
            //   4533c9               | dec                 eax
            //   4533c0               | mov                 ecx, dword ptr [esp + 0xd0]
            //   33d2                 | dec                 eax

        $sequence_5 = { b964000000 e8???????? e9???????? 33d2 488b8c24d0000000 ff15???????? 488b8c24d0000000 }
            // n = 7, score = 6900
            //   b964000000           | mov                 dword ptr [esp + 0x48], eax
            //   e8????????           |                     
            //   e9????????           |                     
            //   33d2                 | dec                 eax
            //   488b8c24d0000000     | cmp                 dword ptr [esp + 0x48], 0
            //   ff15????????         |                     
            //   488b8c24d0000000     | add                 eax, edx

        $sequence_6 = { 03c2 25ff000000 2bc2 488b4c2440 898108010000 488b442440 }
            // n = 6, score = 6900
            //   03c2                 | movzx               eax, word ptr [esp + 0x70]
            //   25ff000000           | dec                 eax
            //   2bc2                 | mov                 edx, dword ptr [esp + 0x68]
            //   488b4c2440           | dec                 eax
            //   898108010000         | mov                 ecx, dword ptr [esp + 0x40]
            //   488b442440           | dec                 eax

        $sequence_7 = { 0f84c9000000 488b442428 8b4c2458 8908 488b4c2460 e8???????? }
            // n = 6, score = 6900
            //   0f84c9000000         | dec                 eax
            //   488b442428           | lea                 edx, [esp + 0x90]
            //   8b4c2458             | dec                 eax
            //   8908                 | mov                 ecx, dword ptr [esp + 0x20]
            //   488b4c2460           | dec                 eax
            //   e8????????           |                     

        $sequence_8 = { 0faee8 e8???????? 8b451b 894304 0f10451f 0f114308 0f104d2f }
            // n = 7, score = 100
            //   0faee8               | mov                 edx, dword ptr [esp + 0x78]
            //   e8????????           |                     
            //   8b451b               | dec                 eax
            //   894304               | lea                 ecx, [esp + 0x28]
            //   0f10451f             | dec                 eax
            //   0f114308             | mov                 ecx, dword ptr [esp + 0x78]
            //   0f104d2f             | dec                 eax

        $sequence_9 = { 48634804 48837c314800 450f45f5 440b743110 440bf3 4183e617 4489743110 }
            // n = 7, score = 100
            //   48634804             | xor                 eax, eax
            //   48837c314800         | dec                 eax
            //   450f45f5             | mov                 ecx, dword ptr [esp + 0x40]
            //   440b743110           | dec                 eax
            //   440bf3               | arpl                word ptr [ecx + 0x108], cx
            //   4183e617             | dec                 eax
            //   4489743110           | mov                 edx, dword ptr [esp + 0x40]

        $sequence_10 = { 3bd1 7d43 2bca 4863f9 85c9 7e3a 0f1f00 }
            // n = 7, score = 100
            //   3bd1                 | movzx               ecx, byte ptr [edx + ecx]
            //   7d43                 | add                 eax, ecx
            //   2bca                 | cdq                 
            //   4863f9               | and                 edx, 0xff
            //   85c9                 | dec                 eax
            //   7e3a                 | lea                 ecx, [esp + 0x28]
            //   0f1f00               | dec                 eax

        $sequence_11 = { 483bfd 75c6 488bac2490000000 498bc6 49891e 488b4c2458 4833cc }
            // n = 7, score = 100
            //   483bfd               | dec                 eax
            //   75c6                 | cmp                 dword ptr [esp + 0x20], 0
            //   488bac2490000000     | jne                 0x1d
            //   498bc6               | mov                 eax, dword ptr [esp]
            //   49891e               | dec                 eax
            //   488b4c2458           | mov                 ecx, dword ptr [esp + 0x20]
            //   4833cc               | movsx               eax, byte ptr [ecx + eax]

        $sequence_12 = { 4157 488dac2430fcffff 4881ecd0040000 488b05???????? 4833c4 488985c0030000 498bd8 }
            // n = 7, score = 100
            //   4157                 | test                eax, eax
            //   488dac2430fcffff     | jne                 0xf
            //   4881ecd0040000       | jmp                 0x1e
            //   488b05????????       |                     
            //   4833c4               | mov                 eax, dword ptr [esp]
            //   488985c0030000       | cmp                 eax, 0x7a
            //   498bd8               | jg                  0x11

        $sequence_13 = { 4883781807 7603 488b00 ba14000000 895c2428 4889442420 4d8b4d38 }
            // n = 7, score = 100
            //   4883781807           | mov                 ecx, dword ptr [esp + 0x40]
            //   7603                 | dec                 eax
            //   488b00               | mov                 dword ptr [esp + 0x48], eax
            //   ba14000000           | dec                 eax
            //   895c2428             | cmp                 dword ptr [esp + 0x48], 0
            //   4889442420           | jne                 0xf
            //   4d8b4d38             | jmp                 0x15

        $sequence_14 = { 0f1145f8 f20f104f10 f20f114d08 8b4718 894510 48634714 85c0 }
            // n = 7, score = 100
            //   0f1145f8             | add                 esp, 0x38
            //   f20f104f10           | ret                 
            //   f20f114d08           | dec                 eax
            //   8b4718               | mov                 dword ptr [esp + 8], ecx
            //   894510               | dec                 eax
            //   48634714             | sub                 esp, 0x18
            //   85c0                 | mov                 dword ptr [esp], 0

        $sequence_15 = { 0f95c0 84c0 741e 4885c9 750b 488d0d90110700 48894b40 }
            // n = 7, score = 100
            //   0f95c0               | movsx               eax, byte ptr [esp + 0x20]
            //   84c0                 | sub                 eax, 0x47
            //   741e                 | mov                 word ptr [esp + 0x24], ax
            //   4885c9               | jmp                 0x1b
            //   750b                 | dec                 eax
            //   488d0d90110700       | mov                 eax, dword ptr [esp + 0x40]
            //   48894b40             | jne                 8

    condition:
        7 of them and filesize < 2467840
}

Download all Yara Rules

Latrodectus Propose Change

References

Yara Rules

Latrodectus