Executive Summary
Latrodectus is a sophisticated multi-stage malware loader characterized by its use of legitimate software packaging tools and extensive masquerading techniques. This specific variant employs an infection chain starting with a ZIP-based PowerShell dropper that retrieves second-stage payloads from MediaFire. The final payload is delivered via an MSI installer created with Advanced Installer, which installs malicious components disguised as SentinelOne security software.
The malware exhibits high technical proficiency by abusing legitimate Windows utilities such as msiexec.exe and msbuild.exe to bypass security controls. It establishes deep system persistence through multiple registry run keys and startup folder modifications. The primary objective involves system reconnaissance, including the collection of MachineGuids and certificate store enumeration, to facilitate C2 communication and potentially deploy further payloads like ransomware.
Latrodectus represents a significant threat due to its ability to evade traditional signature-based detection. At the time of analysis, the final payload (SentinelAgentWorker.exe) had zero detections on VirusTotal. Organizations should prioritize behavioral detection and monitor for the abuse of legitimate installer frameworks and unusual registry modifications.