Resubmissions

21-09-2021 13:21

210921-qltfashfc5 10

20-09-2021 11:39

210920-nsfrnsgefn 8

General

  • Target

    test.test

  • Size

    249KB

  • Sample

    210921-qltfashfc5

  • MD5

    69c9b5e0c3e6346f468ed148fc318529

  • SHA1

    4ad69a31a65172cdcaa6e3ea1afad7b4e30b88d9

  • SHA256

    3026fb99476bfb40357573b15fc63c0c63b1e9bd99f8266e91da21b80fe903cf

  • SHA512

    6f1bc5ea61583efe89c372bdbcdccb52b3b8571a0acf5d41f07e7111dd00af0adeab4dd93c1b8384b153354117b8e81fa63045e5bdc63eae4384652c627f379d

Malware Config

Extracted

Family

squirrelwaffle

C2

agora.360cyberlink.com/wpuDolwbH9c9

panel.betfredtakeaway.com/awJPDGElQ

believeinus.net/S6y8WsHm

onlinecourses.mirrainternationaluniversity.com/VnCSkt13PkuT

reward.tyrehamperpromotion.co.uk/GWJ3gHMtUdk

panels.betfredtakeaway.com/0PKIQI4OFxD

ambassade-mauritanie-rabat.net/hovwkJJaIt8

bitcoinup.bafflepoetry.org/uTyCcQUDkCX3

pwcgov-x.gq/doMZFSHYs

business-a.ml/lDyw7Vs3x

unifarma.com.br/6GREencD

digitalmaster.online/rgzce1W5g

patatec.com/OTfcXmew

megasoftsol.com/R26csFnDY

authentification.scanandrace.com/m1xwraBcBFN

new.actsgeneration.org/1vXSPxRR3bR

lagochapala.com.mx/DplUgNSqWfc

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Targets

    • Target

      test.test

    • Size

      249KB

    • MD5

      69c9b5e0c3e6346f468ed148fc318529

    • SHA1

      4ad69a31a65172cdcaa6e3ea1afad7b4e30b88d9

    • SHA256

      3026fb99476bfb40357573b15fc63c0c63b1e9bd99f8266e91da21b80fe903cf

    • SHA512

      6f1bc5ea61583efe89c372bdbcdccb52b3b8571a0acf5d41f07e7111dd00af0adeab4dd93c1b8384b153354117b8e81fa63045e5bdc63eae4384652c627f379d

    • SquirrelWaffle is a simple downloader written in C++.

      SquirrelWaffle.

    • squirrelwaffle

      Squirrelwaffle Payload

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks