Latrodectus score: all-tools team, hosted DeepSeek, run 5

The reference sample run under the importable all-tools team with a real sandbox, on a hosted model, for the second time. Team all_tools (three static analysts, a Ghidra reverser, then the dynamic and network stages; see An all-tools team), model deepseek-flash (DeepSeek, hosted) through the OpenAI-compatible provider with compat = deepseek, thinking on and reasoning_effort = max, a 1,048,576-token window, output caps of 393,216 tokens for every analyst, the judge and the report model, no spend ceiling, and analysts run in parallel (parallel_analysts auto). Sandbox: Hatching Triage, a 600 s run. The job completed in 9,578 s, with a persisted report, no degraded-run banner and no failed analyst. The cost was 3.07 USD, computed from the recorded token counts at the published prices; the runner recorded no balance, so there is no charge to check it against.

The run's artefacts do not record the commit. It ran on dev after the fixes that followed run 4: the claim reader that counts unread blocks, a validation turn on every revision answer, the function map, the host-identifier and configuration-value checks, the publish rule for unattributed addresses, and streaming for every hosted call.

The method and the scoring surface are the same as for run 4 and the local run and are described in the all-tools series.

TotalsCopy Anchor Link

43 found / 11 partly (10 in the body, 1 in the appendix only) / 2 missed / 1 wrong, and 27 facts beyond the human reports (below).

Against run 4 (45 / 9 / 2 / 1): 6 items better, 9 worse, 42 the same.

• A deeper command table, a weaker install story. The gains are the items run 4's claim reader lost: the task name Updater with its COM chain and logon trigger, command 0xc as an operator-driven download and start, command 0x11 as a process exit, and the counter-0 registration block with &mac=, &computername= and &domain=. The fix to the claim reader held: it now states what it could not read ("began 11, 10 were read, 1 could not be read") and every revision answer gets a validation turn.
• The losses are one misreading, repeated. Custom_update and Update_%x are framed as a staged payload path under a resolved shell folder, and \update_data.dat as a downloaded staging file. No section says the sample copies itself to %APPDATA%\Custom_update\ or reads replacement C2 addresses from update_data.dat. That one reading costs seven items.
• Command 0xf is still wrong, now as "teardown-and-exit" rather than "uninstall". The analysts' own claims ("teardown … re-launch") describe an update; the report body dropped the re-launch.
• Report correctness is the best so far. All 37 configuration rows and all 43 host-identifier rows hold their value in a cited entry, every one of 19 sandbox addresses is marked no: with a reason, and no redaction mask appears in the report.
• More than twice run 4's cost, and slower. 3.07 against 1.39 USD for run 4 counted the same way (1.36 charged), and 9,578 against 7,603 s. Part of that came from the platform defects listed below, not from the analysis.

What the claims held and the report did notCopy Anchor Link

decode_string_blobs again tied every key string to the function that uses it. This time the reverser described most of them (the mutex, the self-delete stream, the task name, the group string, the RC4 key, the reply keywords and files/bp.dat), and they reach the body. The two key-relevant functions read and never described are the bot-id routine and the update_data.dat reader.

Item by itemCopy Anchor Link

Build and later items (consistency checks, not scored): the RC4 key 12345 is found, with its call site. Littlehw is stated and is on B's list, but its numeric group id is not computed. The beacon ver and up fields are not stated. Both C2 domains are on B's list of 47. The shell-folder set read through the Shell Folders key is stated but not tied to the install path. Command 0x15 is read as a module run from a file mapping, which fixes run 4's "download to disk".

Beyond the human reportsCopy Anchor Link

Each fact below is stated in the report body and is held by no item of the human reports' key (K1–K11), and none of B, E or P states it for this hash. The run's own evidence proves each one; the evidence id and the tool follow each line.

1. Compile TimeDateStamp 2024-03-25 15:54:25 UTC — ev_0004 pe_info.
2. Export-directory name UpdaterTag.dll — ev_0004 pe_info; ev_0045 r2 list_functions.
3. Five sections, highest entropy .data 6.48, no packer signature — ev_0004 pe_info.
4. The static import table is exactly five imports (PeekNamedPipe, GetLastError, CreateMutexW, MessageBeep, MessageBoxA) — ev_0004 pe_info.
5. No Authenticode signature — ev_0003 signing_info.
6. This build's string-cipher parameters: seed 0x33629d40, first key 0x41, mostly UTF-16LE; the decoder at 0xae78 reads the seed, the length and the data and steps the key through a helper at 0x9040 — ev_0021 decode_string_blobs; ev_0333 Ghidra decompile_function.
7. Resolver layout: hash tables at 0x9484 (90), 0x904C (24), 0xA59C (37 ntdll), 0xAC50 (3 ole32), with module-name hashes at 0x84E4, 0xA47C and 0xABD4 — ev_0020 resolve_api_hashes.
8. The export resolver at 0x869c reads e_lfanew, the export directory, the name count and the name array; the PEB getter at 0x8690 reads gs:[0x60] — ev_0008 capa; ev_0110 and ev_0114 Ghidra batch_decompile; ev_0122 Ghidra read_memory.
9. Crypto and hash routines: CRC32 at 0x6aa4 (polynomial 0xEDB88320), FNV-1a at 0xc99c (basis 0x811C9DC5, prime 0x01000193), RC4 PRGA at 0xcaac and KSA at 0xcbe0 — ev_0008 capa; ev_0334, ev_0344, ev_0341, ev_0343 Ghidra decompile_function.
10. This hash's C2 pair, both on /live/, decoded by 0xae78 inside 0x6988 and referenced at 0x69b3 and 0x6a1f — ev_0019 FLOSS; ev_0021 decode_string_blobs.
11. The decoder's output slot becomes argument 1 of the call to 0xbc1c at 0x69e2 and 0x6a4e — ev_0021 decode_string_blobs.
12. The C2 bases go into a two-entry gateway array at 0x10568; an operator list at 0x109a8 is preferred when non-empty, and the base is chosen by the beacon counter modulo the count — ev_0107 and ev_0135 Ghidra decompiles.
13. This hash's group string is Littlehw (blob 0xfb10, used in 0x463c), FNV-1a-hashed into group= — ev_0021 decode_string_blobs; ev_0344 Ghidra decompile_function.
14. WinINet request flags 0x04080000 | 0x00803000 (secure; certificate name and date errors ignored) — ev_0077 r2 decompile_function.
15. Content-Type: application/x-www-form-urlencoded (blob 0xfb68) and the POST / GET verbs in the request builder — ev_0021 decode_string_blobs; ev_0019 FLOSS.
16. Base64 alphabet at 0x10160, encoder 0x6634, decoder 0x6370 — ev_0021; ev_0135 and ev_0099 Ghidra decompiles.
17. Reply handlers: split on CRLF and then |, CLEARURL → 0xce20, URLS → 0xccbc, COMMAND → 0x3cf4, ERROR compared with no handler — ev_0127 Ghidra decompile_function.
18. The command-dispatch table (2 → 0x1a08, 3 → 0x1c38, 4 → 0x2118, 0xc → 0x6e04, 0xd → 0x6c2c, 0xe → 0x7170, 0x12 → 0x4110, 0x15 → 0x72c8 → 0xb670, 0x13 and 0x14 → flags 0x1058c and 0x10590, 0x11 → the ExitProcess slot 0x10b68) — ev_0134 Ghidra decompile_function.
19. A pre-beacon delay of 0x708 × 100 ms, about 180 s — ev_0135 Ghidra decompile_function.
20. The recon runner at 0x1030: inheritable security attributes, three inheritable handles, a STARTUPINFO with flags 0x101, and CreateProcessW through a resolved slot; each command is decoded in 0x2200 — ev_0057 r2 decompile_function; ev_0021.
21. Task construction beyond name, COM and logon: trigger type 9 named LogonTrigger, settings PT0S, the action template at 0x35ee, the builder chain 0x33ac → 0x3728 → 0xb344 → 0xc5e8 with the trigger in 0xc2c4 and the settings in 0xc7b4, the class-identifier constant at 0xe040 — ev_0019 FLOSS; ev_0021; ev_0108 Ghidra batch_decompile; ev_0070 r2 decompile_function.
22. The rundll32 launcher at 0xb4cc with the templates C:\WINDOWS\SYSTEM32\rundll32.exe %s,%s and … %s, reached from 0x6c2c and 0x4110 — ev_0021; ev_0048 r2 decompile_function; ev_0116 and ev_0129 Ghidra.
23. Staging name templates %s%d.dll, %s%d.exe, %s\%d.dll, %d.dat, and the argument template init -zzzz="%s\%s" — ev_0021 decode_string_blobs.
24. Registry access is read-only: the Shell Folders key is read in 0x7b98, and 0x88f8 decodes \Registry\Machine\ and calls RtlFormatCurrentUserKeyPath — ev_0021; ev_0081 r2 decompile_function; ev_0117 Ghidra.
25. VirusTotal: 52 of 75 engines — ev_0018 get_file_report.
26. Domain reputation: 16 of 91 and 20 of 91 engines for the two C2 domains — ev_0031 and ev_0032 get_domain_report.
27. The sandbox record: two rundll32.exe <sample>.dll,#1 processes, ordinal 1 — ev_0012 sandbox_processes.

27 facts beyond the human reports. (Run 4: 19. Local 6: 12.)

Not counted: wrong, or not proven by the evidence.

• Command 0xf as "teardown-and-exit" and 0x12 as "update" (wrong labels).
• update_data.dat and Custom_update\Update_%x as fetch staging paths (wrong purpose).
• :wtfbbq as a single-instance marker, in one section.
• curl/7.88.1 on the C2 request: the string is referenced only in the desktop-link handler.
• Command 0x15 as a file mapping whose entry point is then called: the reverser's assessment, not checked against the evidence.
• T1055 "corroborated", and T1008 and T1041 as techniques (the facts behind them are counted in 12 and 18).
• The sentence that the run's own ATT&CK tagging is empty.

Reverse direction: claims no human report supportsCopy Anchor Link

What this run changedCopy Anchor Link

The run exposed platform defects. Each was fixed in the code that followed:

• The debate ends when nothing is left to settle. One contradiction in the mediator's list, however immaterial, kept the debate open: a count of decoded blobs, then a claim its author had already withdrawn. The debate ran five rounds, four of them with revisions. The mediator now marks each contradiction it lists as blocking or not blocking, and an unmarked one blocks. The counts held by the cited evidence entries are put to it, and a revision round that changes nothing ends the debate as converged. The debate stage's recorded duration now also counts the revision rounds; this run's summary under-recorded it by about 40 minutes.
• Revisions record what they drop. A revision replaced the answer in force wholesale, and the reverser's claims fell from 52 to 17 across the rounds with nothing recording it; the beacon-type mapping (K6.6) was lost this way. A revision's dropped claims are now recorded.
• The whole technique line is read. The reader accepted one technique per claim, and a line such as "T1027, T1140" was re-asked. It was behind 29 re-asks, and the only reason for 13. The line is now read as a whole.
• The validator reads inflections. It flagged a true claim ("deobfuscates its own obfuscated strings") for sharing no term with the technique it supports. It now matches word forms.
• The family is on the STIX malware object. The object was passed through as the judge wrote it ("UpdaterTag.dll loader", not a family) although the report's family is Latrodectus. A family object is now added from the verdict's family, and the judge's object is related to it.
• Network values are defanged everywhere in the report. The strings-of-note table and one quoted claim printed the C2 URLs and domains live.
• Raw unparsed answers are kept. Five revision answers read no claims on the first attempt, and the raw text was kept in no artefact, so format drift could not be told from reader strictness. The raw answer is now stored.

The model-side findings stay open: the Custom_update and update_data.dat misreading, the 0xf and 0x12 labels, and T1055 over-claimed as corroborated.

The runCopy Anchor Link

Part of the cost and of the wall time came from the defects above: the debate rounds kept open by the contradiction rule and the re-asks on technique lines account for most of the difference from run 4, and no scored item depends on the rounds they added. The debate took 3,550 s of the 9,578 s, against 1,778 s in run 4. With no spend ceiling, nothing stopped it.

The sandbox record shows the DLL loaded as rundll32.exe <sample>.dll,#1 and nothing beyond it; the report states what was observed there and marks the rest as assessed. This is a single run.