Overview

overview

10

Static

static

Datop/test.test.dll

windows7_x64

1

Datop/test.test.dll

windows10_x64

3

Datop/test1.test.dll

windows7_x64

10

Datop/test1.test.dll

windows10_x64

10

Datop/test2.test.dll

windows7_x64

1

Datop/test2.test.dll

windows10_x64

3

specificat...09.xls

windows7_x64

10

specificat...09.xls

windows10_x64

10

qrzteemm.dll

windows7_x64

10

qrzteemm.dll

windows10_x64

10

specificat...09.xls

windows7_x64

10

specificat...09.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2021-09-22-malware-samples-for-Squirrelwaffle-with-Qakbot-and-Cobalt-Strike.zip

  • Size

    613KB

  • Sample

    210924-v37fpshdh3

  • MD5

    661e43cc4510b34a4fc8c1eca6fe1e61

  • SHA1

    ef13b1ecc8e00e7ff340c55101834744a1c90a70

  • SHA256

    50b3a811481295d5a9f00df228a89eb6bb56d99e313ba1fcfa4e1f606975cbc5

  • SHA512

    fa8fb6a1d9e245a4ffca1e8ee9f89d621d06f16023f6bfa4a16befa9259cada77942f3afd37afe643bc3ed01108f8f215da3ed6e1e775e0d674d04ebbcab48e5

Score
10/10
qakbotsquirrelwaffletr1632152742bankerdownloaderstealertrojan

Malware Config

Extracted

Family

squirrelwaffle

C2

atertreat.in/5iPPVRKPPX9

incentivaconsultores.com.co/55jHpKCc9DWy

cdelean.org/0qvbbmu9g

bazy.ps/M6SjrMSYC

sukmabali.com/ZXxcLYs3rzRQ

bugwilliam.tk/cbB56YrugdbW

bestbeatsgh.com/42D7OwuPen

krumaila.com/UZ4NdDoDh4Tu

razehub.com/NN70nExbtLO

arcb.ro/aHUUNxE3Me5

cfmi.tg/m40YS6gDO0

sweetlittle.mx/ZCXP0dT2h

alkimia-prod.com/nT0imyzmo

almexperts.co.za/fEoJ3pdWZbF

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://ricardopiresfotografia.com/RpuaNlWy/host.html

xlm40.dropper

https://keysite.com.co/IQ3mbS6EF/host.html

xlm40.dropper

https://colegiobilinguepioxii.com.co/SYqvKoF4/host.html

Extracted

Family

qakbot

Version

402.318

Botnet

tr

Campaign

1632152742

C2

45.46.53.140:2222

144.139.47.206:443

189.210.115.207:443

120.150.218.241:995

47.22.148.6:443

140.82.49.12:443

24.139.72.117:443

24.229.150.54:995

24.55.112.61:443

136.232.34.70:443

95.77.223.148:443

173.21.10.71:2222

76.25.142.196:443

96.37.113.36:993

71.74.12.34:443

73.151.236.31:443

67.165.206.193:993

109.12.111.14:443

68.204.7.158:443

105.198.236.99:443

Targets

    • Target

      Datop/test.test

    • Size

      297KB

    • MD5

      508fb618684f3dfb732d3aa8927c69ba

    • SHA1

      475aa7d58b285565251935c4c5982ffdb188fe8a

    • SHA256

      db0652616b6441bd7f45f9dcc7e3d2c2cd4d75df704c9a5c334b7e9c3acc2f2f

    • SHA512

      861e24210c1027f53a9c0ea127f7d9f22978852c2e4adc7f43e3ff00f065b341b3130f1493c475a688800cbc4d3cf3627b5c15df988676c98de86d88827104b9

    Score
    3/10
    behavioral1behavioral2

    • Target

      Datop/test1.test

    • Size

      302KB

    • MD5

      0a359f52ad35a8d335019332274d3c88

    • SHA1

      3a2c847631d1d3592762c5c9abd7367e4d15cd1b

    • SHA256

      de7efe687330b83242dbd1dc00b380933b238b490ba6ba2617330bdf54d1a9ea

    • SHA512

      f9502c7ef0d25357b6ed3a62f834b10b695c03c99ccabff6cf40d0fb15eeed1a696ce3025f9d2af08e85a3446562ee2c96bdacbeae4015ef0a2ed2faaf6f4d13

    Score
    10/10
    squirrelwaffledownloader

    • SquirrelWaffle is a simple downloader written in C++.

      SquirrelWaffle.

      downloadersquirrelwaffle

    • squirrelwaffle

      Squirrelwaffle Payload

    • Blocklisted process makes network request

    behavioral3behavioral4

    • Target

      Datop/test2.test

    • Size

      297KB

    • MD5

      be3f95b2ff9a56376525fa48c9db1553

    • SHA1

      f3db37da2369b083f8828bc8ba5ac4c7232983d4

    • SHA256

      868246c1861a22c681d47fdc102215a9c9f7551985f6abcbfb7b983f1cffadbe

    • SHA512

      2ea4b718f870d509c5e2b51954fefe4e916f705f7820963e37e14f7285612beca2c78181a9ba016855d08c74b51ef5d002d0da79b9dde0a82dccc1a83f67e59f

    Score
    3/10
    behavioral5behavioral6

    • Target

      specification-730729009.xls

    • Size

      258KB

    • MD5

      18df8b279d3bb6c443eea9c9efc47636

    • SHA1

      03125e165dccb330c3bdbc92bab0bf275de626b4

    • SHA256

      9d4d08dd78894b65adc73fe96371f94437f902797fd5ce407aabc9937cd4a5c1

    • SHA512

      ad6bc0babfdb9d8cb92dee36ca2b7e024d52f5adef68f9307de24cbc139cd69369c2be878952b516c18fcc4b7f798e86e382a53f9a42fda77b6abd8ed16e20c6

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral7behavioral8

    • Target

      qrzteemm.dll

    • Size

      306KB

    • MD5

      271e46872af686276374f37977e91f5b

    • SHA1

      059c0c1e15d63f798770775e8722575e00645f21

    • SHA256

      10d1e5d1839bcc7516a19d02f50a354cb982603e25609e019300d1534f928efc

    • SHA512

      7afe86979bb4d4f766ea1027c41da38d8005771c646a90d14812de0577c34e30ff7462ab51e8d2c9d2a8912638d9dafd699fe2a25a5b95af84a9177fb291eeca

    Score
    10/10
    qakbottr1632152742bankerstealertrojan
    behavioral9behavioral10

    • Target

      specification-730729009.xls

    • Size

      258KB

    • MD5

      18df8b279d3bb6c443eea9c9efc47636

    • SHA1

      03125e165dccb330c3bdbc92bab0bf275de626b4

    • SHA256

      9d4d08dd78894b65adc73fe96371f94437f902797fd5ce407aabc9937cd4a5c1

    • SHA512

      ad6bc0babfdb9d8cb92dee36ca2b7e024d52f5adef68f9307de24cbc139cd69369c2be878952b516c18fcc4b7f798e86e382a53f9a42fda77b6abd8ed16e20c6

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral11behavioral12

MITRE ATT&CK Enterprise v6

Tasks