Overview

overview

10

Static

static

a4d7848d13...ea.dll

windows7_x64

10

a4d7848d13...ea.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a4d7848d13ff3e7119820779f0c7267fdd0962116e41d926240b13a3403eeaea.zip

  • Size

    315KB

  • Sample

    211021-ztscmsbfdn

  • MD5

    684f1d28c7f7a48cbd98ed8087037c02

  • SHA1

    28525a17a09965984f882742f01a5f9eb704bdfd

  • SHA256

    7370d5a9b3ac43e12fb899b9b22f46c4e6564e884177f999c0f2bcad2e72d610

  • SHA512

    7107b32f67ee05ab20ad5c6f55c7952b412f371f4e4cfdd99dd9f6ae784492b699ecc7a57b1e928b0a38e1ada405563c78e1ce611eb8b5d6271c63c7b42c956d

Score
10/10
squirrelwaffledownloadersuricata

Malware Config

Extracted

Family

squirrelwaffle

C2

http://bostoncarservice.us/ttv8fU9U19

http://payparq-cloud-3513-01.com/bON7gU8BpvAU

http://luckysoxs.com/3FbCi7ej09p

http://payparq-cloud-8799-02.com/0yXFxtYs0Z

http://rjmholding.com/JKu3ByhTE

http://centroparquekrahmer.cl/iXIdCvMk5TD7

http://capaxion.cl/xigRVxm0X

http://bimcrea.cl/CRUKqDjn

http://payparq-cloud-8899-00.com/yeoXYV97

http://18pixels.org/mDZYHjiJi

http://e2eprocess.cl/EUsDZTqM

http://payparq.com/1DT7hrizVB

http://sammlerstore.pe/KKFuUiXVI5

Targets

    • Target

      a4d7848d13ff3e7119820779f0c7267fdd0962116e41d926240b13a3403eeaea

    • Size

      531KB

    • MD5

      47c0e967f4efba7e10168c48b0547280

    • SHA1

      57481c839e78f5da675a0442b079a850936c5115

    • SHA256

      a4d7848d13ff3e7119820779f0c7267fdd0962116e41d926240b13a3403eeaea

    • SHA512

      3227b5cde15cd967cf8ef39e8ec00dc488bcc28e0d2fb81ffafce459dac0e035d195e42270f3a803ee178620559aeb23c4f3bc8545bb365bdb3a5419a74b9174

    Score
    10/10
    squirrelwaffledownloadersuricata

    • SquirrelWaffle is a simple downloader written in C++.

      SquirrelWaffle.

      downloadersquirrelwaffle

    • suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response

      suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response

      suricata

    • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

      suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

      suricata

    • suricata: ET MALWARE SQUIRRELWAFFLE Server Response

      suricata: ET MALWARE SQUIRRELWAFFLE Server Response

      suricata

    • Squirrelwaffle Payload

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks