Latrodectus Malware Masquerades as AhnLab Security Software to Infect Victims

This report analyzes the Latrodectus downloader (MeDExt.dll), detailing its malicious behavior (COM-based scheduled task persistence), C2 communications, and infrastructure discovered via TLS certificate pivoting; it lists multiple associated domains, IPs, and file hashes and highlights the risk of the downloader deploying additional payloads (notably Brute Ratel C4).