Overview

overview

10

Static

static

309252610b...bd.dll

windows7_x64

10

309252610b...bd.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    309252610b617ea7a4ae736381f6364c6bb154ce81ce0883c69ca98a284943bd

  • Size

    235KB

  • Sample

    220130-s224gsdcbp

  • MD5

    7d00207e3d8c2c562ab3d3bfd8a71fe2

  • SHA1

    1529d54632c0289440154c6f11e2730e609a0663

  • SHA256

    309252610b617ea7a4ae736381f6364c6bb154ce81ce0883c69ca98a284943bd

  • SHA512

    06d9632cd00e3f2ec168a3b0c6327d6ec70f40b75607234e71bd09b7b7bec30995ee8d1733e5cd13ead2f343b33e21ac673dea06773b043c32361468212ee979

Score
10/10
squirrelwaffledownloadersuricata

Malware Config

Extracted

Family

squirrelwaffle

C2

http://acdlimited.com/2u6aW9Pfe

http://jornaldasoficinas.com/ZF8GKIGVDupL

http://orldofjain.com/lMsTA7tSYpe

http://altayaralsudani.net/SSUsPgb7PHgC

http://hoteloaktree.com/QthLWsZsVgb

http://aterwellnessinc.com/U7D0sswwp

http://sirifinco.com/Urbhq9wO50j

http://ordpress17.com/5WG6Z62sKWo

http://mohsinkhanfoundation.com/pcQLeLMbur

http://lendbiz.vn/xj3BhHtMbf

http://geosever.rs/ObHP1CHt

http://nuevainfotech.com/xCNyTjzkoe

http://dadabhoy.pk/m6rQE94U

http://111

http://sjgrand.lk/zvMYuQqEZj

http://erogholding.com/GFM1QcCFk

http://armordetailing.rs/lgfrZb4Re6WO

http://lefrenchwineclub.com/eRUGdDox

Targets

    • Target

      309252610b617ea7a4ae736381f6364c6bb154ce81ce0883c69ca98a284943bd

    • Size

      235KB

    • MD5

      7d00207e3d8c2c562ab3d3bfd8a71fe2

    • SHA1

      1529d54632c0289440154c6f11e2730e609a0663

    • SHA256

      309252610b617ea7a4ae736381f6364c6bb154ce81ce0883c69ca98a284943bd

    • SHA512

      06d9632cd00e3f2ec168a3b0c6327d6ec70f40b75607234e71bd09b7b7bec30995ee8d1733e5cd13ead2f343b33e21ac673dea06773b043c32361468212ee979

    Score
    10/10
    squirrelwaffledownloadersuricata

    • SquirrelWaffle is a simple downloader written in C++.

      SquirrelWaffle.

      downloadersquirrelwaffle

    • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

      suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

      suricata

    • Squirrelwaffle Payload

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks