General
-
Target
www2.bin.zip
-
Size
173KB
-
Sample
210924-rpcsdshca9
-
MD5
0d7eca2bf6e54f4c0feb2b9b663c5d71
-
SHA1
cd8d16261e2ad153e00295f6bb9ef8569caeb1c6
-
SHA256
27fe65cd73ff1a6419ec3fd67afae07f0bbdbc241d43faa7f9257d27f93c5bf2
-
SHA512
4b26c9cb0b718193706dbe9aefeef127a8176e956bc6e8c6e3b9fe5d768330acf82a098c381bffc92bd71e5019487eda45d84c0fe6de0965ef164ba5da33d627
Malware Config
Extracted
squirrelwaffle
spiritofprespa.com/9783Tci2SGF6
amjsys.com/RIZszf8vR
hrms.prodigygroupindia.com/SKyufGZV
centralfloridaasphalt.com/GCN0FChS
jhehosting.com/rUuKheB7
shoeclearanceoutlet.co.uk/46awDTJjI4l
kmslogistik.com/aS1mjTkJIy
bartek-lenart.pl/1bWJ57V9vx
voip.voipcallhub.com/ZVmfdGHs4T
mercyfoundationcio.org/XF9aQrXnakeG
key4net.com/a8A2kcc1J
chaturanga.groopy.com/mxN3lxZoVApc
voipcallhub.com/ilGht5r26
ems.prodigygroupindia.com/v5RvVJTz
novamarketing.com.pk/k8l36uus
lenartsa.webd.pro/fz16DjmKmHtl
lead.jhinfotech.co/YERjiAMaupaz
-
blocklist
94.46.179.80
206.189.205.251
88.242.66.45
85.75.110.214
87.104.3.136
207.244.91.171
49.230.88.160
91.149.252.75
91.149.252.88
92.211.109.152
178.0.250.168
88.69.16.230
95.223.77.160
99.234.62.23
2.206.105.223
84.222.8.201
89.183.239.142
5.146.132.101
77.7.60.154
45.41.106.122
45.74.72.13
74.58.152.123
88.87.68.197
211.107.25.121
109.70.100.25
185.67.82.114
207.102.138.19
204.101.161.14
193.128.108.251
111.7.100.17
Targets
-
-
Target
www2.bin
-
Size
334KB
-
MD5
84a32095bcbc0ed694f09f1dd8f2a70f
-
SHA1
23f7334db6979f04d5a2a9a846f82c526bfe6736
-
SHA256
671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e
-
SHA512
e3db14700e24210d1e2f1c19fcbb1b7074d73f5cdc4cbaf737b9a92a4f3b8d9b71efaa450aac9f7f4baef1ca8463f0668a3d72b888e0d39195e4c6115de5012a
Score10/10-
SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
-
squirrelwaffle
Squirrelwaffle Payload
-
Blocklisted process makes network request
-