General
-
Target
www2.bin.zip
-
Size
173KB
-
Sample
210924-rpcsdshca9
-
MD5
0d7eca2bf6e54f4c0feb2b9b663c5d71
-
SHA1
cd8d16261e2ad153e00295f6bb9ef8569caeb1c6
-
SHA256
27fe65cd73ff1a6419ec3fd67afae07f0bbdbc241d43faa7f9257d27f93c5bf2
-
SHA512
4b26c9cb0b718193706dbe9aefeef127a8176e956bc6e8c6e3b9fe5d768330acf82a098c381bffc92bd71e5019487eda45d84c0fe6de0965ef164ba5da33d627
Malware Config
Extracted
squirrelwaffle
spiritofprespa.com/9783Tci2SGF6
amjsys.com/RIZszf8vR
hrms.prodigygroupindia.com/SKyufGZV
centralfloridaasphalt.com/GCN0FChS
jhehosting.com/rUuKheB7
shoeclearanceoutlet.co.uk/46awDTJjI4l
kmslogistik.com/aS1mjTkJIy
bartek-lenart.pl/1bWJ57V9vx
voip.voipcallhub.com/ZVmfdGHs4T
mercyfoundationcio.org/XF9aQrXnakeG
key4net.com/a8A2kcc1J
chaturanga.groopy.com/mxN3lxZoVApc
voipcallhub.com/ilGht5r26
ems.prodigygroupindia.com/v5RvVJTz
novamarketing.com.pk/k8l36uus
lenartsa.webd.pro/fz16DjmKmHtl
lead.jhinfotech.co/YERjiAMaupaz
-
blocklist
94.46.179.80
206.189.205.251
88.242.66.45
85.75.110.214
87.104.3.136
207.244.91.171
49.230.88.160
91.149.252.75
91.149.252.88
92.211.109.152
178.0.250.168
88.69.16.230
95.223.77.160
99.234.62.23
2.206.105.223
84.222.8.201
89.183.239.142
5.146.132.101
77.7.60.154
45.41.106.122
45.74.72.13
74.58.152.123
88.87.68.197
211.107.25.121
109.70.100.25
185.67.82.114
207.102.138.19
204.101.161.14
193.128.108.251
111.7.100.17
111.7.100.16
74.125.210.62
74.125.210.36
104.244.74.57
185.220.101.145
185.220.101.144
185.220.101.18
185.220.100.246
185.220.101.228
185.220.100.243
185.220.101.229
185.220.101.147
185.220.102.250
185.220.100.241
199.195.251.84
213.164.204.94
74.125.213.7
74.125.213.9
185.220.100.249
37.71.173.58
93.2.220.100
188.10.191.109
81.36.17.247
70.28.47.118
45.133.172.222
108.41.227.196
37.235.53.46
162.216.47.22
154.3.42.51
45.86.200.60
212.230.181.152
185.192.70.11
14.33.131.72
94.46.179.80
206.189.205.251
178.255.172.194
84.221.205.40
155.138.242.103
178.212.98.156
85.65.32.191
31.167.184.201
88.242.66.45
36.65.102.42
203.213.127.79
85.75.110.214
93.78.214.187
204.152.81.185
183.171.72.218
168.194.101.130
87.104.3.136
92.211.196.33
197.92.140.125
207.244.91.171
49.230.88.160
196.74.16.153
91.149.252.75
91.149.252.88
92.206.15.202
82.21.114.63
92.211.109.152
178.0.250.168
178.203.145.135
85.210.36.4
199.83.207.72
86.132.134.203
88.69.16.230
99.247.129.88
37.201.195.12
87.140.192.0
88.152.185.188
87.156.177.91
99.229.57.160
95.223.77.160
88.130.54.214
99.234.62.23
2.206.105.223
94.134.179.130
84.221.255.199
84.222.8.201
89.183.239.142
87.158.21.26
93.206.148.216
5.146.132.101
77.7.60.154
95.223.75.85
162.254.173.187
50.99.254.163
45.41.106.122
99.237.13.3
45.74.72.13
108.171.64.202
74.58.152.123
216.209.253.121
88.87.68.197
211.107.25.121
109.70.100.25
185.67.82.114
207.102.138.19
204.101.161.14
193.128.108.251
111.7.100.17
111.7.100.16
74.125.210.62
74.125.210.36
104.244.74.57
185.220.101.145
185.220.101.144
185.220.101.18
185.220.100.246
185.220.101.228
185.220.100.243
185.220.101.229
185.220.101.147
185.220.102.250
Targets
-
-
Target
www2.bin
-
Size
334KB
-
MD5
84a32095bcbc0ed694f09f1dd8f2a70f
-
SHA1
23f7334db6979f04d5a2a9a846f82c526bfe6736
-
SHA256
671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e
-
SHA512
e3db14700e24210d1e2f1c19fcbb1b7074d73f5cdc4cbaf737b9a92a4f3b8d9b71efaa450aac9f7f4baef1ca8463f0668a3d72b888e0d39195e4c6115de5012a
Score10/10-
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
-
squirrelwaffle
Squirrelwaffle Payload
-
Blocklisted process makes network request
-