Latrodectus score: all-tools team, local Qwen3.6-35B

The reference sample run under the importable all-tools team with a real sandbox, on a local model. dev @ 4d80c62e, team all_tools (three static analysts, a Ghidra reverser, then the dynamic and network stages; see An all-tools team), model Qwen3.6-35B-A3B on ik_llama.cpp with thinking off, a 131,072-token window probed from the server, output caps of 32,768 tokens for every analyst, the judge and the report model, no spend ceiling. The server had one slot, so the analysts ran one after another. Sandbox: Hatching Triage, a 600 s run. The job completed in 8,373 s.

The method is the benchmark's, with the all-tools series' scoring surface: the 57 core items of K1–K10 (K1.1 split into family and loader), scored on the report body, the STIX bundle and the /iocs feed.

• partly (body): the body states part of the item, or states it with the wrong purpose.
• partly (appendix): the value is printed only in the report's appendix.
• A behaviour that a string only hints at counts as missed.
• wrong: the body states something the human reports contradict.

Human sources: B Bitsight (names this hash), E Elastic, P Proofpoint.

TotalsCopy Anchor Link

15 found / 21 partly (14 body, 7 appendix) / 21 missed / 0 wrong, and 12 facts beyond the human reports (below).

• The best local found count of the all-tools series, still with nothing wrong, and far below the hosted run's 45.
• The gains are the C2 channel and the task. The POST to /live/, the fixed User-Agent, and T1053.005, published from the sandbox's "Uses Task Scheduler COM API" signature.
• The losses are strings the report did not repeat. Custom_update, Update_%x and Updater are in the appendix only, because no claim named them.
• The analysis is not deeper. The reverser decompiled 42 distinct functions, including every function the decoded strings of the key items are used in, and described none of them in a claim, even when asked once.

What the evidence had and the report did notCopy Anchor Link

The triage pack gave every analyst FLOSS, resolve_api_hashes and decode_string_blobs, which ties each decoded string to the function that uses it. The reverser decompiled each of these functions; no claim describes any of them, so these key items stayed missed or appendix-only:

The platform asked once about the decompiled functions no claim described; the kept answer still named 41 of 42 in no claim, and the report says so.

Item by itemCopy Anchor Link

Build and later items (consistency checks, not scored): the first C2 domain, stated as C2, is on B's list of 47; the second is published but never called a C2. The RC4 key 12345, the group Littlehw and the stealer field &stiller= are in the appendix only.

Beyond the human reportsCopy Anchor Link

Each fact below is stated in the report body and is held by no item of the human reports' key (K1–K11), and none of B, E or P states it for this hash. The run's own evidence proves each one; the evidence id and the tool follow each line.

1. Compile TimeDateStamp 2024-03-25 15:54:25 UTC — ev_0004 pe_info.
2. Export-directory name UpdaterTag.dll — ev_0004 pe_info; ev_0035 r2 list_exports.
3. Section layout: five sections, highest entropy .data 6.48, no packer signatures — ev_0004 pe_info.
4. The static import table is exactly five imports (PeekNamedPipe, GetLastError, CreateMutexW, MessageBeep, MessageBoxA) — ev_0004 pe_info; ev_0034 r2 list_imports.
5. No Authenticode signature — ev_0003 signing_info.
6. The string decoder is the routine at 0xae78 — ev_0019 floss (every decoded string names it); ev_0073 Ghidra decompile_function.
7. The export-table resolver is at 0x869c — ev_0008 capa ("resolve function by parsing PE exports" at 0x869c); ev_0086 Ghidra decompile_function.
8. The runtime API surface: 164 names resolved from CRC32 hashes across kernel32, user32, wininet, shell32, advapi32, urlmon, shlwapi and iphlpapi, with the WinINet, URLDownloadToFileW, Toolhelp32 and SHGetFolderPathW names stated — ev_0020 resolve_api_hashes.
9. This hash's C2 pair, both on /live/, decoded by 0xae78 inside 0x6988 at 0x69b3 and 0x6a1f from file offsets 0xe050 and 0xe078 — ev_0019 floss; ev_0021 decode_string_blobs.
10. Where each decoded C2 URL goes next: the decoder's output slot [rsp+0x40] becomes argument 1 of the call to 0xbc1c, at 0x6a4e for the first URL and 0x69e2 for the second — ev_0021 decode_string_blobs.
11. VirusTotal: 52 of 75 engines, analysis of 2026-08-23 — ev_0018 get_file_report.
12. The sandbox record: two rundll32.exe <sample>.dll,#1 processes, i.e. the load is by ordinal 1 — ev_0012 sandbox_processes.

12 facts beyond the human reports.

Not counted: wrong, or not proven by the evidence.

• Persistence by Active Setup and the Startup folder (T1547.001 and T1547.014 published): contradicted by B and E, whose only persistence is the Updater task; it rests on a sandbox signature.
• 63 "host identifier" rows naming registry keys that no evidence entry holds.
• A sandbox address (104[.]18[.]…) stated as the C2's infrastructure: the sandbox attributes no flow to the sample, and the IOC feed does not publish it.
• Remote-process injection, privilege escalation, Volume Shadow Copy deletion and IE-settings changes: generic sandbox signatures with no call site.
• "Exfiltration Interval 1000": not in the cited evidence entry.
• "Six dropped files": sandbox memory dumps, not the sample's drops.
• The sandbox's SCSI-registry signature as the sample's own check: its process is not stated, so it is not counted, though it may be right.
• T1000 and T1042 (not valid ATT&CK ids), T1048, T1134, T1490, T1112 and T1083 as stated.

Reverse direction: claims no human report supportsCopy Anchor Link

The runCopy Anchor Link

Three analysts — static, dynamic and network — answered from the triage pack without calling a tool even after being asked to. One analyst's answer ran to its 32,768-token cap repeating claims, which the platform caught after the answer and asked about once. This is a single run.