Back 
概要
Latrodectus is a downloader first discovered by Walmart back in October of 2023. The malware became very famous due to its similarities with the famous IcedID malware, not only in the code itself but also the infrastructure, as previously reported by Proofpoint and Team Cymru S2.
The malware is usually delivered via email spam campaigns conducted by two specific threat actors: TA577 and TA578. Among the several features it contains is the ability to download and execute additional payloads, collect and send system information to the C2, terminate processes, and more. In July of 2024 Latrodectus was also observed being delivered by a BRC4 badger.
During the Threat Labs hunting activities we discovered a new version of the Latrodectus payload, version 1.4. The malware updates include a different string deobfuscation approach, a new C2 endpoint, two new backdoor commands, and more.
In this blog, we will focus on the features added/updated in this new version.
JavaScript file analysis
The first payload of the infection chain is a JavaScript file obfuscated using a similar approach used by other Latrodectus campaigns. The obfuscation technique is employed by adding several comments into the file, making it more difficult to be analyzed as well as increasing the file size considerably.
The relevant code is present in between the junk comments and once removed from the file we can see the code that would be executed.