General

  • Target

    de90ff76dc7cfeac247b3522576241406045c5b8f20088497b001e7fe6a7434f

  • Size

    213KB

  • Sample

    220121-21ljsacden

  • MD5

    f2ac112f91721ffda97a8313d4c8445c

  • SHA1

    9f9f463f846ee6387d6dc10d835f046a8b7d5ea6

  • SHA256

    de90ff76dc7cfeac247b3522576241406045c5b8f20088497b001e7fe6a7434f

  • SHA512

    b8d4026ac672488f65ec558e83eb2812d6338b2ff61368444479869ba1b1089169eee8cec08613a11982dfd7ca0170b7a189deed9cb887e895ef884a712eeb29

Malware Config

Extracted

Family

squirrelwaffle

C2

http://spiritofprespa.com/9783Tci2SGF6

http://amjsys.com/RIZszf8vR

http://hrms.prodigygroupindia.com/SKyufGZV

http://centralfloridaasphalt.com/GCN0FChS

http://jhehosting.com/rUuKheB7

http://shoeclearanceoutlet.co.uk/46awDTJjI4l

http://kmslogistik.com/aS1mjTkJIy

http://bartek-lenart.pl/1bWJ57V9vx

http://voip.voipcallhub.com/ZVmfdGHs4T

http://mercyfoundationcio.org/XF9aQrXnakeG

http://key4net.com/a8A2kcc1J

http://chaturanga.groopy.com/mxN3lxZoVApc

http://voipcallhub.com/ilGht5r26

http://ems.prodigygroupindia.com/v5RvVJTz

http://novamarketing.com.pk/k8l36uus

http://lenartsa.webd.pro/fz16DjmKmHtl

http://lead.jhinfotech.co/YERjiAMaupaz

Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    211.107.25.121

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

Targets

    • Target

      de90ff76dc7cfeac247b3522576241406045c5b8f20088497b001e7fe6a7434f

    • Size

      213KB

    • MD5

      f2ac112f91721ffda97a8313d4c8445c

    • SHA1

      9f9f463f846ee6387d6dc10d835f046a8b7d5ea6

    • SHA256

      de90ff76dc7cfeac247b3522576241406045c5b8f20088497b001e7fe6a7434f

    • SHA512

      b8d4026ac672488f65ec558e83eb2812d6338b2ff61368444479869ba1b1089169eee8cec08613a11982dfd7ca0170b7a189deed9cb887e895ef884a712eeb29

    • SquirrelWaffle is a simple downloader written in C++.

      SquirrelWaffle.

    • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

      suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    • Squirrelwaffle Payload

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks