General

  • Target

    0be2467c140a096809775cd9e279f0c0a6d629a73ce666e4ac5205e387e5d0ba

  • Size

    66KB

  • Sample

    211113-v6gpfsccal

  • MD5

    159f694415b8ef42a8b1073d28531b78

  • SHA1

    bfa3ffe1fa960a42789cae49acee18cfb6844c04

  • SHA256

    0be2467c140a096809775cd9e279f0c0a6d629a73ce666e4ac5205e387e5d0ba

  • SHA512

    40a1720ad7ede3bd4c203a6702691e97c51bfd4797f9df84bae3a36733ac64e6c6e828be9617618db6b50ffed957ce6a0e0eee5b44f8f5b22bd71cf4bea12150

Malware Config

Extracted

Family

squirrelwaffle

C2

http://celulasmadreenmexico.com.mx/Wt793Aua

http://gerencial.institutoacqua.org.br/XynFkhJAxnm

http://dashboard.adlytic.ai/LlvLoc9O3

http://bussiness-z.ml/3pdEiqsni

http://ifiengineers.com/hGVc55g2e

http://bonusvulkanvegas.srdm.in/U7oOxmI1m

http://ebrouteindia.com/JEqGe1hNR

http://test.dirigu.ro/dXf4cS4GPL

http://cablingpoint.com/LjDG0hkp

http://perfectdemos.com/T6PQGYCMt

http://afrizam.360cyberlink.com/f36rjSN5D1

http://giasuphire.tddvn.com/miFO43YP9b

http://priyacareers.com/GiTHMPbU

http://assurant.360cyberlink.com/DGx4k8U9Hil

http://sig.institutoacqua.org.br/tM7tINg2sCU

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Targets

    • Target

      0be2467c140a096809775cd9e279f0c0a6d629a73ce666e4ac5205e387e5d0ba

    • Size

      66KB

    • MD5

      159f694415b8ef42a8b1073d28531b78

    • SHA1

      bfa3ffe1fa960a42789cae49acee18cfb6844c04

    • SHA256

      0be2467c140a096809775cd9e279f0c0a6d629a73ce666e4ac5205e387e5d0ba

    • SHA512

      40a1720ad7ede3bd4c203a6702691e97c51bfd4797f9df84bae3a36733ac64e6c6e828be9617618db6b50ffed957ce6a0e0eee5b44f8f5b22bd71cf4bea12150

    Score
    10/10
    • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

      suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks