Latrodectus score: all-tools team, hosted DeepSeek

The reference sample run under the importable all-tools team with a real sandbox, on a hosted model. dev @ ceb4244a, team all_tools (three static analysts, a Ghidra reverser, then the dynamic and network stages; see An all-tools team), model deepseek-flash (DeepSeek, hosted) through the OpenAI-compatible provider with compat = deepseek, thinking on and reasoning_effort = max, a 1,048,576-token window, output caps of 393,216 tokens for every analyst, the judge and the report model, and a spend ceiling of 2.00 USD. Sandbox: Hatching Triage, a 600 s run. The job completed in 7,603 s and was charged 1.36 USD.

The method and the scoring surface are the same as for the local run and are described in the all-tools series.

TotalsCopy Anchor Link

45 found / 9 partly / 2 missed / 1 wrong, and 19 facts beyond the human reports (below).

• The best report of the benchmark. 32 of the 39 main items found, and no item left in the appendix alone.
• One item is wrong. Command 0xf is labelled "uninstall"; B, E and P give it as update.
• The new deterministic tools paid off. resolve_api_hashes named IsWow64Process (K3.3, the first time in any run) and the volume APIs behind the bot id; decode_string_blobs joined the RC4 key, the group, the self-delete rename token, the install folder and update_data.dat to the functions that use them. With names in hand, the reverser decompiled every command handler.

What the claims held and the report did notCopy Anchor Link

Two losses happened between the analysts and the report:

• A revision answer replaced 38 claims with 3. The reverser's revision began 18 claims and only 3 were read: 15 ended their confidence line with a full stop, which the claim reader did not parse, and the loss was recorded nowhere. Had those claims been read, K7.12, K7.17 and K5.2 with its IOC would have been found.
• The report dropped one claim that was read. The MAC-address check (K3.4) was in three analysts' final claims and is not in the body.

The spend ceiling latched early. One refused debate turn marked the whole ceiling exhausted at 0.98 USD of 2.00, so the second revision round and the mediator's tool loop did not run, and the report opens with a degraded-run banner. No scored item was lost to it directly.

Item by itemCopy Anchor Link

Build and later items (consistency checks, not scored): the RC4 key 12345, the beacon version 1.2 and the group Littlehw are stated, and both C2 domains are on B's list of 47. The group's numeric id and up are not stated.

Beyond the human reportsCopy Anchor Link

Each fact below is stated in the report body and is held by no item of the human reports' key (K1–K11), and none of B, E or P states it for this hash. The run's own evidence proves each one; the evidence id and the tool follow each line.

1. Compile TimeDateStamp 2024-03-25 15:54:25 UTC — ev_0004 pe_info.
2. Export-directory name UpdaterTag.dll — ev_0004 pe_info.
3. Section layout: five sections, highest entropy .data 6.48, no packer signature — ev_0004 pe_info.
4. The static import table is exactly five imports from KERNEL32.dll and USER32.dll (PeekNamedPipe, GetLastError, CreateMutexW, MessageBeep, MessageBoxA) — ev_0004 pe_info.
5. No Authenticode signature — ev_0003 signing_info.
6. The string decoder is the routine at 0xae78 — ev_0019 floss; ev_0089 r2 decompile_function; ev_0168 Ghidra batch_decompile.
7. The export-table resolver is at 0x869c — ev_0008 capa.
8. The CRC32 table routine is at 0x6aa4 and the FNV routine at 0xc99c — ev_0008 capa.
9. RC4 PRGA at 0xcaac — ev_0008 capa.
10. The runtime API surface: 164 embedded values resolve to Windows functions and modules across about ten DLLs — ev_0020 resolve_api_hashes.
11. This hash's C2 pair, both on /live/, decoded from .data and referenced at 0x69b3 and 0x6a1f inside 0x6988 — ev_0019 floss; ev_0021 decode_string_blobs.
12. VirusTotal: 52 of 75 engines — ev_0018 get_file_report.
13. The sandbox record: the load as rundll32.exe <sample>.dll,#1, an ordinal-1 call, and no dropped file — ev_0012 sandbox_processes; ev_0015 sandbox_dropped_files.
14. The ntdll resolution block at 0xa59c: the routine places 37 {hash, module, slot} triples against one module-name pointer and resolves each through 0x869c — ev_0204 Ghidra decompile_function; the hashes it holds resolve to ntdll names, which is what names the module — ev_0020 resolve_api_hashes.
15. The decoded C2 URLs are written into a candidate slot array at 0x10568 by 0x6988 — ev_0090 r2 decompile_function; ev_0182 Ghidra batch_decompile.
16. The C2 reply handlers: URLS → 0xccbc, CLEARURL → 0xce20, COMMAND → 0x3cf4 — ev_0195 and ev_0171 Ghidra batch_decompile.
17. The command handlers' addresses: the desktop-link collector 0x1a08, the process-list collector 0x1c38, the in-memory loader 0x7170 and the self-delete routine 0x3a24 — ev_0185, ev_0193 and ev_0184 Ghidra batch_decompile.
18. The request routine 0x5030 calls InternetSetOptionA(hRequest, 0x1f, &0x4380, 4); 0x4380 is the combination of the flags that ignore revocation, an unknown CA, wrong usage and a redirect to HTTPS — ev_0129 r2 decompile_function (the flag names are the constant's arithmetic).
19. A 180 s wait (0x708 × 100 ms) before first contact, in the beacon thread 0x5750 — ev_0169 Ghidra batch_decompile.

19 facts beyond the human reports. An earlier checklist count over the same report put it at about 22; this list counts only the facts whose evidence entry was checked again for this page.

Not counted: wrong, or not proven by the evidence.

• The task named "LogonTrigger": LogonTrigger is the trigger string; the name Updater is passed to the registration call.
• Command 0xf as "uninstall" (B, E and P: update), and 0x15 as a download to disk (B: an in-memory plugin).
• The copy's extension "chosen opposite to its own type", and T1036.008 published on it: probably wrong; under rundll32 the copy is a .dll.
• Hash-resolved API names described as "imports" in the T1055 and T1071.001 rows.
• "Mozilla/IE and curl user agents" for the C2 channel: the curl string is used only in the desktop-link handler.
• The key reused for the update_data.dat file: no decompile of its source is cited.
• "GET" as the context of the URL indicators: the beacon is POST.
• The statement that the two collectors were not decompiled: they were.

Reverse direction: claims no human report supportsCopy Anchor Link

The runCopy Anchor Link

The sample stayed inert in the sandbox: its own gates stopped it on a four-process guest, so no C2 contact, drop or task registration was observed, and the report says why. This is a single run.