Overview

overview

10

Static

static

21f6d76a33...7a.dll

windows7_x64

10

21f6d76a33...7a.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21f6d76a335c8c98e7d27e42f77c8bd167e79a02914cc4c7ea49c3600c48e57a

  • Size

    300KB

  • Sample

    220130-tfjwfsdfdq

  • MD5

    a10379c50615514343a479c964554c37

  • SHA1

    c292f39617bee5f26ab76db955851c78d1b26e9e

  • SHA256

    21f6d76a335c8c98e7d27e42f77c8bd167e79a02914cc4c7ea49c3600c48e57a

  • SHA512

    5241b736ba45b0e23f45f62a09a817c940e85d0a62bf4dd2943d9c81fdade4c3038bcc96d4c5f2d2a9ee1797eaf90d4d9541a0d6699950e413fc4ed1411174d9

Score
10/10
squirrelwaffledownloadersuricata

Malware Config

Extracted

Family

squirrelwaffle

C2

http://hutraders.com/0eeUtmJf8O

http://goodartishard.com/0JXDM9kMwx

http://now.byteinsure.com/tnjUrmlhN

http://asceaub.com/Xl8UCLSU

http://colchonesmanzur.com/GjVgBnKaNIC

http://sistemasati.com/0SzGNkx6P

http://maldivehost.net/zLIisQRWZI9

http://lrdgon.org/l7r96tjAJ

http://binnawaz.com.pk/jhSZGWS76C

http://fhstorse.com/vJlgdjJnpIop

Targets

    • Target

      21f6d76a335c8c98e7d27e42f77c8bd167e79a02914cc4c7ea49c3600c48e57a

    • Size

      300KB

    • MD5

      a10379c50615514343a479c964554c37

    • SHA1

      c292f39617bee5f26ab76db955851c78d1b26e9e

    • SHA256

      21f6d76a335c8c98e7d27e42f77c8bd167e79a02914cc4c7ea49c3600c48e57a

    • SHA512

      5241b736ba45b0e23f45f62a09a817c940e85d0a62bf4dd2943d9c81fdade4c3038bcc96d4c5f2d2a9ee1797eaf90d4d9541a0d6699950e413fc4ed1411174d9

    Score
    10/10
    squirrelwaffledownloadersuricata

    • SquirrelWaffle is a simple downloader written in C++.

      SquirrelWaffle.

      downloadersquirrelwaffle

    • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

      suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

      suricata

    • Squirrelwaffle Payload

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks