Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID

Elastic Security Labs analyzes LATRODECTUS, a lightweight malware loader first observed in late 2023 and increasingly used in financially motivated email campaigns. The report details its unpacking, string-decryption and runtime-import techniques, anti-analysis checks (PEB, process counts, WOW64, MAC address), persistence (scheduled Updater task), self-deletion via alternate data streams, RC4+Base64 C2 communication (hardcoded password “12345”), and command handlers that retrieve system data and download/execute PE, DLL, shellcode, and ICEDID payloads; it also includes IOCs and detection guidance (YARA, ES|QL hunts, behavioral rules).