General

  • Target

    50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af

  • Size

    333KB

  • Sample

    220130-sa8ryscfgn

  • MD5

    89f3552453768e9e7474c4815fd5610f

  • SHA1

    c3ce353c9c460b1dc40248738dfbcdbcdcccac7d

  • SHA256

    50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af

  • SHA512

    d99f5e068a7b516c4024cd18bcc567b555aadec3d9e35593061563c7f26f9f28162d5b0bd7cba0739dc654e04d68c69d66b9bb065faafb570451fe408fc15d95

Malware Config

Extracted

Family

squirrelwaffle

C2

http://atertreat.in/5iPPVRKPPX9

http://incentivaconsultores.com.co/55jHpKCc9DWy

http://cdelean.org/0qvbbmu9g

http://bazy.ps/M6SjrMSYC

http://sukmabali.com/ZXxcLYs3rzRQ

http://bugwilliam.tk/cbB56YrugdbW

http://bestbeatsgh.com/42D7OwuPen

http://krumaila.com/UZ4NdDoDh4Tu

http://razehub.com/NN70nExbtLO

http://arcb.ro/aHUUNxE3Me5

http://cfmi.tg/m40YS6gDO0

http://sweetlittle.mx/ZCXP0dT2h

http://alkimia-prod.com/nT0imyzmo

http://almexperts.co.za/fEoJ3pdWZbF

Targets

    • Target

      50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af

    • Size

      333KB

    • MD5

      89f3552453768e9e7474c4815fd5610f

    • SHA1

      c3ce353c9c460b1dc40248738dfbcdbcdcccac7d

    • SHA256

      50dd23567232e3c1ea49ea5c8fe2060a56a8f59b0445b464d7c28ad9cd6156af

    • SHA512

      d99f5e068a7b516c4024cd18bcc567b555aadec3d9e35593061563c7f26f9f28162d5b0bd7cba0739dc654e04d68c69d66b9bb065faafb570451fe408fc15d95

    • SquirrelWaffle is a simple downloader written in C++.

      SquirrelWaffle.

    • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

      suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    • Squirrelwaffle Payload

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks