General

  • Target

    080605882c52fa3d534906acb724a5fc2fdb2ef7d9174331988eccc30b269ec7

  • Size

    223KB

  • Sample

    220130-t42feaeddk

  • MD5

    6f8a6c096e3531d7af23a91ec2be61d6

  • SHA1

    7a591595101e05f78aa1057b14379888ad7c57cf

  • SHA256

    080605882c52fa3d534906acb724a5fc2fdb2ef7d9174331988eccc30b269ec7

  • SHA512

    5057c45b742b3d5c568e843bf4240fb58292339177dce95e79c3194b07e02ac94e8884346f0e9d33261adc61bfb9d7f1edd26629e1cc4d4787d355f17942ce8e

Malware Config

Extracted

Family

squirrelwaffle

C2

http://pop.vicamtaynam.com/VtyiHAft

http://snsvidyapeeth.in/aXmo2Dr3

http://trinitytesttubebaby.com/QR2JvfE3Sv

http://iconskw.com/cqdPtAbZ

http://ebookchuyennganh.com/v9PMvQDxHK8W

http://alsader.net/BHdQaiQ9rt

http://avyanshglobal.com/6pYjPlqf

http://primahills-online.com/ypCiZn7tMx

http://antoniocastroycia.com.co/WHe08obY

http://apexbiotech.net/VQgunQ4t5Ue

http://vscm.in/V3tYKxDz

http://sinaloworx.co.za/3GilA8Eo3r

http://dancongnghe.xyz/yRByhX6J3REI

http://trajesuniformes.com.br/qQofZMaJm

http://fiorenzapaes.com.br/PGYpETW7

http://astetinternational.com/arW5e44Y7vzO

http://razisystem.ir/MqvvkX0cWvn

http://krishnaiti.org.in/rWA02HQY4

Targets

    • Target

      080605882c52fa3d534906acb724a5fc2fdb2ef7d9174331988eccc30b269ec7

    • Size

      223KB

    • MD5

      6f8a6c096e3531d7af23a91ec2be61d6

    • SHA1

      7a591595101e05f78aa1057b14379888ad7c57cf

    • SHA256

      080605882c52fa3d534906acb724a5fc2fdb2ef7d9174331988eccc30b269ec7

    • SHA512

      5057c45b742b3d5c568e843bf4240fb58292339177dce95e79c3194b07e02ac94e8884346f0e9d33261adc61bfb9d7f1edd26629e1cc4d4787d355f17942ce8e

    • SquirrelWaffle is a simple downloader written in C++.

      SquirrelWaffle.

    • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

      suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    • Squirrelwaffle Payload

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks