General

  • Target

    4aaae627ad4d7e56521555d5bcc8ab7b0c7d740ae480dda84ebd4dd5ff1c529e.zip

  • Size

    138KB

  • Sample

    210927-tgnk2ahdfq

  • MD5

    7299f00135a3d5c97c31fa5cea4d2cf9

  • SHA1

    90b76664c2fbc733e7388f41f72a738d2de1d68a

  • SHA256

    2a4938399b3fd16242cc44e18e2c76a9ba52d69e3dc31c1303ef8ba9f45fc60f

  • SHA512

    9ea854fd37d2d6be0821abee94039321c298b07a74389bd7af0f5e50ab12fb91ac8980ee696ef54c4e27498a555dbe01b924300971006c0410df94f7b2a95332

Malware Config

Extracted

Family

squirrelwaffle

C2

spiritofprespa.com/9783Tci2SGF6

amjsys.com/RIZszf8vR

hrms.prodigygroupindia.com/SKyufGZV

centralfloridaasphalt.com/GCN0FChS

jhehosting.com/rUuKheB7

shoeclearanceoutlet.co.uk/46awDTJjI4l

kmslogistik.com/aS1mjTkJIy

bartek-lenart.pl/1bWJ57V9vx

voip.voipcallhub.com/ZVmfdGHs4T

mercyfoundationcio.org/XF9aQrXnakeG

key4net.com/a8A2kcc1J

chaturanga.groopy.com/mxN3lxZoVApc

voipcallhub.com/ilGht5r26

ems.prodigygroupindia.com/v5RvVJTz

novamarketing.com.pk/k8l36uus

lenartsa.webd.pro/fz16DjmKmHtl

lead.jhinfotech.co/YERjiAMaupaz

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    211.107.25.121

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

Targets

    • Target

      4aaae627ad4d7e56521555d5bcc8ab7b0c7d740ae480dda84ebd4dd5ff1c529e

    • Size

      215KB

    • MD5

      05354cccb97a79f37567df322951bc07

    • SHA1

      2d32a75f34bb188ce4caf5d7e1634df7236164fa

    • SHA256

      4aaae627ad4d7e56521555d5bcc8ab7b0c7d740ae480dda84ebd4dd5ff1c529e

    • SHA512

      970706f507780dd808a3c6faa962c71a7f18819ff8aacc330b49644c3faaea5ad991c91a2383558618a3b2881daa683d3024dd4ff794647d8e2031dbfe080e54

    • SquirrelWaffle is a simple downloader written in C++.

      SquirrelWaffle.

    • suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response

      suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response

    • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

      suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    • suricata: ET MALWARE SQUIRRELWAFFLE Server Response

      suricata: ET MALWARE SQUIRRELWAFFLE Server Response

    • squirrelwaffle

      Squirrelwaffle Payload

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks