General

Malware Config

Signatures

Files

• SquirrelWaffle_13Oct.zip

  .zip

  Password: infected

• 029b714502283599a5efb86d41c48fd46751ab727b707bde620e517ec3aa3c39

  .dll windows x64 regsvr32

  
  

  Exports

  Exports

  DllRegisterServer

  DllUnregisterServer

  NevtAmdfxsoZubqmdnz

  QotlcerqxcgFjxvwybou

  ResumeServer

  StartServer

  StartW

  StopServer

  SuspendServer

• 061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52

  .dll windows x86

  
  
• 06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2

  .dll windows x86

  
  

  Exports

  Exports

  Clotheleft

  Deal

  Degreehill

  HotWhich

• 24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365

  .dll windows x86

  
  
• 260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840

  .dll windows x86

  
  

  Exports

  Exports

  Dreamteam

  Fat

  Noseconsonant

  Productdetermine

  SleepRow

  Tencolumn

• 26cd03696045fb93b415b022fa6bc832098394bf362f4b4c4e897e9550d12618

  .dll windows x86

  
  
• 2a0a88a2e5f9cafa10a48d63bdfcdf965b72c25978ab46cf28e795dbedc9624a

  .dll windows x86

  
  
• 2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894

  .dll windows x64 regsvr32

  
  

  Exports

  Exports

  DllRegisterServer

  DllUnregisterServer

  PauseW

  ResumeServer

  ResumeW

  StartServer

  StartW

  StopServer

  SuspendServer

• 336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da

  .dll windows x86

  
  

  Exports

  Exports

  Bluetall

  Corncolony

  Fightpick

  Fruitfinger

  GardenEye

  Imaginesuffix

  Moon

  Stringbegan

• 417c1828d98ba4f05f7a2edb71a9105f0aebf3d554393970b96e59d4db7b4473

  .dll windows x64 regsvr32

  
  

  Exports

  Exports

  DllMain

  DllRegisterServer

  aawfkxanmu

  bjxdtpzpja

  bplquqv

  esmygxeweibbzlvfq

  focasmpwnvhevaz

  frbrxdd

  fzyigtqsvbg

  ggeoddxznpnsyn

  growgalqdxhxviac

  jmerprmuux

  lwhftvobcvl

  mcenyyupirkncqetf

  mmzzltoxqtyrkivr

  mokwimawtz

  nitgwxxlg

  nryejpsoh

  ojkvuqioyvm

  orvgguynmlqupaf

  qkmzugif

  qmqfykidactgi

  rust_eh_personality

  sfwvovbeflcksj

  svfjwahcyy

  tgpfvjgvbdk

  uegzzufylglcm

  vhmuzntvbnm

  xmfhcnrznjgtdns

  yestpkccojoxxqc

  yneelblsyvyd

  yvrdwwkscdjka

  yygysmqyvqnncfhq

  yywceeuwsplhjtb

• 4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee

  .dll windows x86

  
  
• 54e526fe059a3f25cdaed954e32f44eadffb3e51548658409468dcf2d63b634c

  .dll windows x86

  
  
• 6402b33d729c8bb44881747a8f397f4aec408bf5e18b9af6fd86cdfa3f96323b

  .dll windows x86

  
  

  Exports

  Exports

  Doctor

  Herevalue

  Liemore

  Morningthere

  QuestionPoint

  Ranexample

  Tryconsonant

  Weregentle

• 64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb

  .dll windows x86

  
  
• 671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e

  .dll windows x86

  
  

  Exports

  Exports

  Centermade

  Fewhour

  Happennext

  Homewho

  LeastFarm

  Propertywar

  Thicksoon

  Where

• 67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce

  .dll windows x86 regsvr32

  
  

  Exports

  Exports

  ?FeHZqSetAC_nYiCIQEfCjAQtxRZuSIPZwncfVQRfA@@YG_NXZ

  ?MoPQiYrOCh_pQJSARGrFwKBJ@@YG_NXZ

  ?MsmtmdpOeK_zStVpoZaVSBLnmSiAIdnJApWncGhLr@@YG_NXZ

  ?OBhLcwQbLs_tFwofVZRKzoSGiBNbeT@@YG_NXZ

  ?QqCTihFhgr_ujweaupWNWrfkMBWx@@YG_NXZ

  ?Vjwhgvipi_MfZyIqCMDSNwPJgIoTftXlIEUL@@YG_NXZ

  ?XCGRrSfMFg_zoCaPBnAwKWPqV@@YG_NXZ

  ?YhmCMUtuKH_pOposJymAeEhWXVNyaolEvMyGIj@@YG_NXZ

  ?ZCgJJXtDkm_OBepfhRXBFYOsGYJNoOJMAGJgXqW@@YG_NXZ

  ?cTlmLKuX_xFuYWorUncSAdHWdmypAwHVKX@@YG_NXZ

  ?czQegkMwRQ_YGIjjiuEuN@@YG_NXZ

  ?fKjhnGgOh_pQeFQGcAeOkfcWaSmCkAfWW@@YG_NXZ

  ?gpHVQosg_svntMpPJUTJYbxqJInjbuWVGXv@@YG_NXZ

  ?iPSEYhfRmv_PHrCcRxJWVOwvmp@@YG_NXZ

  ?oOuNKdibjl_yXZEbFQedJPvHBYVVOHPpytZXqghSp@@YG_NXZ

  ?qHYtTcVltg_oewJZkIfVYjRIwc@@YG_NXZ

  ?sQdeeuerzj_PilEZSQkmoETQvTyeI@@YG_NXZ

  ?ucYdYBAlND_viEbTyJVtsJhqITGSfTiWNeYUpCanz@@YG_NXZ

  ?uhKQtgRLdp_YAjrpDsjHvJgYLiHlanMASfGIPpJ@@YG_NXZ

  DllRegisterServer

  MfZyIqCMDSNwPJgIoTftXlIEUL

  OBepfhRXBFYOsGYJNoOJMAGJgXqW

  PHrCcRxJWVOwvmp

  PilEZSQkmoETQvTyeI

  YAjrpDsjHvJgYLiHlanMASfGIPpJ

  YGIjjiuEuN

  nYiCIQEfCjAQtxRZuSIPZwncfVQRfA

  oewJZkIfVYjRIwc

  pOposJymAeEhWXVNyaolEvMyGIj

  pQJSARGrFwKBJ

  pQeFQGcAeOkfcWaSmCkAfWW

  svntMpPJUTJYbxqJInjbuWVGXv

  tFwofVZRKzoSGiBNbeT

  ujweaupWNWrfkMBWx

  viEbTyJVtsJhqITGSfTiWNeYUpCanz

  xFuYWorUncSAdHWdmypAwHVKX

  yXZEbFQedJPvHBYVVOHPpytZXqghSp

  zStVpoZaVSBLnmSiAIdnJApWncGhLr

  zoCaPBnAwKWPqV

• 6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb

  .dll windows x64 regsvr32

  
  

  Exports

  Exports

  DllRegisterServer

  DllUnregisterServer

  PauseW

  ResumeServer

  ResumeW

  StartServer

  StartW

  StopServer

  SuspendServer

• 6f63742c25fd3a2dae5995f182254c253003066488ef86e754f661e8ba1d76fd

  .dll windows x86

  
  

  Exports

  Exports

  Anddoctor

  Beatlay

  Drivesilent

  Need

  Satbaby

  Saveon

  TriangleType

• 813a9b03c6c1caec4eca8a867dcfbda7860bca6a5d481acb4c131c1a868d4b48

  .dll windows x86

  
  

  Exports

  Exports

  Centermade

  Fewhour

  Happennext

  Homewho

  LeastFarm

  Propertywar

  Thicksoon

  Where

• 839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3

  .dll windows x86

  
  

  Exports

  Exports

  Generalcenter

  Modern

  MySand

  Youhow

• 85d0b72fe822fd6c22827b4da1917d2c1f2d9faa838e003e78e533384ea80939

  .dll windows x86

  
  

  Exports

  Exports

  Centermade

  Fewhour

  Happennext

  Homewho

  LeastFarm

  Propertywar

  Thicksoon

  Where

• a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4

  .dll windows x86

  
  

  Exports

  Exports

  Dropleave

  GlassExercise

  Mehope

  Top

• a55c19c552f579041ad7289aceeb400da215fe29aedbf0c14e8a66be1bee8360

  .dll windows x64 regsvr32

  
  

  Exports

  Exports

  DllRegisterServer

  DllUnregisterServer

  PauseW

  ResumeServer

  ResumeW

  StartServer

  StartW

  StopServer

  SuspendServer

• a98e988f03fd5be37c66878017a3dcd741adf75bf1df1ed6dde2c15ee213bb48

  .dll windows x86

  
  

  Exports

  Exports

  Black

  Bloodbroad

  Callnation

  Foresthome

  JumpCreate

  Lightwind

  Rockline

  Subtractmost

• acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27

  .dll windows x86

  
  
• b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7

  .dll windows x86

  
  

  Exports

  Exports

  Forever

  Hurryindicate

  Knewface

  Radioindicate

  Skill

  Songfelt

  TellWay

• bac73f9ccebf93009a6037145a9c71a2e8b916956f6a7e6a4f4b53b4b50b7a00

  .dll windows x86

  
  
• c5d2f0da18fb33a25b53fd8b9b98f0bfa95458e3c0feb687852f469167a0110c

  .dll windows x64 regsvr32

  
  

  Exports

  Exports

  DllMain

  DllRegisterServer

  aawfkxanmu

  bjxdtpzpja

  bplquqv

  esmygxeweibbzlvfq

  focasmpwnvhevaz

  frbrxdd

  fzyigtqsvbg

  ggeoddxznpnsyn

  growgalqdxhxviac

  jmerprmuux

  lwhftvobcvl

  mcenyyupirkncqetf

  mmzzltoxqtyrkivr

  mokwimawtz

  nitgwxxlg

  nryejpsoh

  ojkvuqioyvm

  orvgguynmlqupaf

  qkmzugif

  qmqfykidactgi

  rust_eh_personality

  sfwvovbeflcksj

  svfjwahcyy

  tgpfvjgvbdk

  uegzzufylglcm

  vhmuzntvbnm

  xmfhcnrznjgtdns

  yestpkccojoxxqc

  yneelblsyvyd

  yvrdwwkscdjka

  yygysmqyvqnncfhq

  yywceeuwsplhjtb

• d559ee0a26fa500cd57fac25d58ba4319a794f329c8711e89afac3c281f9dd7e

  .dll windows x64 regsvr32

  
  

  Exports

  Exports

  DllRegisterServer

  DllUnregisterServer

  PauseW

  ResumeServer

  ResumeW

  StartServer

  StartW

  StopServer

  SuspendServer

• db5276c0d5ecd3b338a98983001a5b8cbbf5b488bf420d8cc0267801b963f479

  .dll windows x64 regsvr32

  
  

  Exports

  Exports

  DllRegisterServer

  DllUnregisterServer

  PauseW

  ResumeServer

  ResumeW

  StartServer

  StartW

  StopServer

  SuspendServer

• e5efde974017a12a573548f12b5473887601c897e8660eb57803c18523f72815

  .dll windows x86

  
  
• fe028e6f99a02a016643a2db14534fa977a78f45b36ff9db5b60e7e709f5541c

  .dll windows x64 regsvr32

  
  

  Exports

  Exports

  DllRegisterServer

  DllUnregisterServer

  PauseW

  ResumeServer

  ResumeW

  StartServer

  StartW

  StopServer

  SuspendServer

• fe281548b6876588af513b971df1d11ee8b917cdb3fbc36c206ccb5a7e6805e3

  .dll windows x86