General

  • Target

    2ac3570a2aa79bd927834c3e2e432bb5e424aa4ef3a58186eaba7e0a68d14104

  • Size

    119KB

  • Sample

    211113-v6hlrafcc8

  • MD5

    3ecc9ca5e744d7ddafa04834c70b95c3

  • SHA1

    ea4e9be41fa3f6895423e791596011f88ba45cde

  • SHA256

    2ac3570a2aa79bd927834c3e2e432bb5e424aa4ef3a58186eaba7e0a68d14104

  • SHA512

    270fd8bba59528f6f036e91fcd2e7c6d0fc2e8318851cdba656594c9bc62c356e4d0a20953e10cc9c8c0d980e34b552009af6b404b1432faee6d519d56f8f254

Score
10/10

Malware Config

Extracted

Family

squirrelwaffle

C2

http://celulasmadreenmexico.com.mx/Wt793Aua

http://gerencial.institutoacqua.org.br/XynFkhJAxnm

http://dashboard.adlytic.ai/LlvLoc9O3

http://bussiness-z.ml/3pdEiqsni

http://ifiengineers.com/hGVc55g2e

http://bonusvulkanvegas.srdm.in/U7oOxmI1m

http://ebrouteindia.com/JEqGe1hNR

http://test.dirigu.ro/dXf4cS4GPL

http://cablingpoint.com/LjDG0hkp

http://perfectdemos.com/T6PQGYCMt

http://afrizam.360cyberlink.com/f36rjSN5D1

http://giasuphire.tddvn.com/miFO43YP9b

http://priyacareers.com/GiTHMPbU

http://assurant.360cyberlink.com/DGx4k8U9Hil

http://sig.institutoacqua.org.br/tM7tINg2sCU

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

    111.7.100.16

Targets

    • Target

      2ac3570a2aa79bd927834c3e2e432bb5e424aa4ef3a58186eaba7e0a68d14104

    • Size

      119KB

    • MD5

      3ecc9ca5e744d7ddafa04834c70b95c3

    • SHA1

      ea4e9be41fa3f6895423e791596011f88ba45cde

    • SHA256

      2ac3570a2aa79bd927834c3e2e432bb5e424aa4ef3a58186eaba7e0a68d14104

    • SHA512

      270fd8bba59528f6f036e91fcd2e7c6d0fc2e8318851cdba656594c9bc62c356e4d0a20953e10cc9c8c0d980e34b552009af6b404b1432faee6d519d56f8f254

    Score
    8/10
    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks