General

  • Target

    4c34acb15071ac857e8f091dec94d779396433b3079c007149ece283d535075b

  • Size

    316KB

  • Sample

    220130-sem12scgcm

  • MD5

    bee1cc89494bb3b2a6aa6d175e727b21

  • SHA1

    a52a916d46299d4561bab420b06a0ad76098816b

  • SHA256

    4c34acb15071ac857e8f091dec94d779396433b3079c007149ece283d535075b

  • SHA512

    019850708e1df0db96ff04e2d151ccabe706f8274a4c88ba530b1c36529c2dd2f2b821471b074d1f6cf2ab3ae5bb8a0b6ed0387fbf6718fa991b0b2234d5c0b7

Malware Config

Extracted

Family

squirrelwaffle

C2

http://atertreat.in/5iPPVRKPPX9

http://incentivaconsultores.com.co/55jHpKCc9DWy

http://cdelean.org/0qvbbmu9g

http://bazy.ps/M6SjrMSYC

http://sukmabali.com/ZXxcLYs3rzRQ

http://bugwilliam.tk/cbB56YrugdbW

http://bestbeatsgh.com/42D7OwuPen

http://krumaila.com/UZ4NdDoDh4Tu

http://razehub.com/NN70nExbtLO

http://arcb.ro/aHUUNxE3Me5

http://cfmi.tg/m40YS6gDO0

http://sweetlittle.mx/ZCXP0dT2h

http://alkimia-prod.com/nT0imyzmo

http://almexperts.co.za/fEoJ3pdWZbF

Targets

    • Target

      4c34acb15071ac857e8f091dec94d779396433b3079c007149ece283d535075b

    • Size

      316KB

    • MD5

      bee1cc89494bb3b2a6aa6d175e727b21

    • SHA1

      a52a916d46299d4561bab420b06a0ad76098816b

    • SHA256

      4c34acb15071ac857e8f091dec94d779396433b3079c007149ece283d535075b

    • SHA512

      019850708e1df0db96ff04e2d151ccabe706f8274a4c88ba530b1c36529c2dd2f2b821471b074d1f6cf2ab3ae5bb8a0b6ed0387fbf6718fa991b0b2234d5c0b7

    • SquirrelWaffle is a simple downloader written in C++.

      SquirrelWaffle.

    • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

      suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    • Squirrelwaffle Payload

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks