MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d82df77582d5ea4c734ccac7c0c6559398e0ff942d8ce49772713b47667380b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Squirrelwaffle


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d82df77582d5ea4c734ccac7c0c6559398e0ff942d8ce49772713b47667380b
SHA3-384 hash: 3e1f577be9282c9d71a4a3a5a6ab660750e3d589cb4120c91643a69733d25e234db503f691f4bd6830a66bcd28792aab
SHA1 hash: 2468ca8a3ddf6c763b7e9378fc4676d90a3f5637
MD5 hash: e8f3bcb2560827a8aee38e739fe927af
humanhash: oscar-three-helium-stream
File name:e8f3bcb2560827a8aee38e739fe927af.dll
Download: download sample
Signature Squirrelwaffle
Create hunting rule
File size:320'541 bytes
First seen:2021-09-25 12:40:32 UTC
Last seen:2021-09-25 14:08:06 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 6527345f9aee9363b094aad01304de88 (4 x Squirrelwaffle, 1 x Quakbot)
ssdeep 6144:9/st+16ZWiobj+n5QZRO0Xj/Ee+aRLvccAOPyI:A+QoOaEFA7RD
Threatray 154 similar samples on MalwareBazaar
TLSH T16664F6A5BD4D8C33FDD8363152836E1C691A3BD3B16C328F326EF6146967F44A892E50
File icon (PE):PE icon
dhash icon 88a8a08c8c8ea8a8 (5 x Squirrelwaffle, 4 x Formbook, 3 x ArkeiStealer)
Reporter abuse_ch
Tags:dll SQUIRRELWAFFLE

Intelligence

File Origin
# of uploads :
2
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/191530/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Qbot.10.11098.11241.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4b42a255-84a2-4e2d-b16a-a2cc9c17a56d
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/858024
Signature
Allocates memory in foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Regsvr32 Command Line Without DLL
Sigma detected: Schedule system process
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 490454 Sample: 0gjwJdebJ1.dll Startdate: 25/09/2021 Architecture: WINDOWS Score: 84 42 Sigma detected: Schedule system process 2->42 44 Machine Learning detection for sample 2->44 46 Machine Learning detection for dropped file 2->46 48 Sigma detected: Regsvr32 Command Line Without DLL 2->48 8 loaddll32.exe 1 2->8         started        11 regsvr32.exe 2->11         started        13 regsvr32.exe 2->13         started        process3 signatures4 50 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->50 52 Injects code into the Windows Explorer (explorer.exe) 8->52 54 Maps a DLL or memory area into another process 8->54 15 cmd.exe 1 8->15         started        17 explorer.exe 8 1 8->17         started        20 regsvr32.exe 11->20         started        22 regsvr32.exe 13->22         started        process5 signatures6 24 rundll32.exe 15->24         started        40 Uses schtasks.exe or at.exe to add and modify task schedules 17->40 27 schtasks.exe 1 17->27         started        29 WerFault.exe 20 9 20->29         started        31 WerFault.exe 9 22->31         started        process7 signatures8 56 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 24->56 58 Injects code into the Windows Explorer (explorer.exe) 24->58 60 Writes to foreign memory regions 24->60 62 2 other signatures 24->62 33 explorer.exe 24->33         started        36 conhost.exe 27->36         started        process9 file10 38 C:\Users\user\Desktop\0gjwJdebJ1.dll, PE32 33->38 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d82df77582d5ea4c734ccac7c0c6559398e0ff942d8ce49772713b47667380b/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2021-09-25 12:41:13 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bwbn652yfvpkjrzuzswhyddfle4y4d7zilmm4slxe4j3i5thhafq._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
095c41270ae3a26ae9efb626be12ed920c44432f3c8cc8ed8ee67d67425c1251
Squirrelwaffle
153862cb79a2312f54a2307460872006138a649cdac6525df1d04c093c8b1454
Squirrelwaffle
1b1ddb8520b8cd70023535854bfe614f99e001d69b22f5bc6890137262cefb0a
Squirrelwaffle
2c544aeae61ee9bad278fc039e69b5ba8ce1861ed440b4704ce479770fc049cb
Squirrelwaffle
4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee
Squirrelwaffle
5b0bf4defd88befa231c4ebe655ae860b180baa8e0331cd6c570d31f6751b9bd
Squirrelwaffle
5e9f3da1a19859c920d3f12c0bffb8ae8b1773fd7f2dd9cc5dce3d4bb50dddc8
Squirrelwaffle
63deda6fe8af221a650f6ba6a2ee6c7fec17f10bc5e063c9b0aaee4981a01150
Squirrelwaffle
7661002966c0c3621224d0c2618488393471ab9c72cd6e1f7592cc49163f23d7
Squirrelwaffle
7c6a9dc5626bd62584851b56ce9e386cf5a494e6c5c2d1e36032798edb9405b0
Squirrelwaffle
+ 144 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:tr campaign:1632152742 banker stealer trojan
Link:
https://tria.ge/reports/210925-pwsq3scfh9/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Malware Config
C2 Extraction:
45.46.53.140:2222
144.139.47.206:443
189.210.115.207:443
120.150.218.241:995
47.22.148.6:443
140.82.49.12:443
24.139.72.117:443
24.229.150.54:995
24.55.112.61:443
136.232.34.70:443
95.77.223.148:443
173.21.10.71:2222
76.25.142.196:443
96.37.113.36:993
71.74.12.34:443
73.151.236.31:443
67.165.206.193:993
109.12.111.14:443
68.204.7.158:443
105.198.236.99:443
75.188.35.168:443
216.201.162.158:443
196.218.227.241:995
185.250.148.74:2222
81.214.126.173:2222
68.186.192.69:443
72.252.201.69:443
92.59.35.196:2222
24.152.219.253:995
50.29.166.232:995
75.67.192.125:443
24.95.61.62:443
73.25.124.140:2222
27.223.92.142:995
64.121.114.87:443
151.205.102.42:443
72.240.200.181:2222
75.137.47.174:443
45.32.211.207:995
45.32.211.207:8443
149.28.98.196:2222
149.28.98.196:995
207.246.77.75:8443
45.63.107.192:995
149.28.99.97:443
45.77.117.108:2222
149.28.99.97:2222
45.32.211.207:2222
45.63.107.192:443
149.28.101.90:443
149.28.101.90:8443
149.28.99.97:995
96.253.46.210:443
83.196.56.65:2222
45.77.115.208:2222
45.77.115.208:8443
45.77.115.208:443
144.202.38.185:443
144.202.38.185:2222
45.32.211.207:443
144.202.38.185:995
149.28.98.196:443
149.28.101.90:2222
45.77.117.108:443
207.246.77.75:995
207.246.77.75:443
207.246.77.75:2222
149.28.101.90:995
45.77.117.108:995
45.77.117.108:8443
45.77.115.208:995
71.163.222.223:443
90.87.245.154:2222
207.246.116.237:995
207.246.116.237:443
45.63.107.192:2222
207.246.116.237:8443
207.246.116.237:2222
24.179.77.236:443
184.185.103.157:443
217.165.164.110:2222
213.122.113.120:443
193.248.221.184:2222
188.27.179.172:443
222.153.169.147:995
100.2.20.137:443
172.78.42.79:443
97.69.160.4:2222
105.198.236.101:443
98.192.185.86:443
186.144.33.73:443
96.61.23.88:995
86.220.60.247:2222
71.41.184.10:3389
175.143.92.16:443
46.149.81.250:443
98.252.118.134:443
92.96.3.180:2078
71.187.170.235:443
50.244.112.106:443
24.122.118.18:443
47.196.213.73:443
186.154.175.13:443
70.163.161.79:443
78.63.226.32:443
76.168.147.166:993
77.27.207.217:995
31.4.242.28:995
125.62.192.195:443
195.12.154.8:443
96.21.251.127:2222
71.199.192.62:443
70.168.130.172:995
82.12.157.95:995
209.210.187.52:995
209.210.187.52:443
67.6.12.4:443
189.222.59.177:443
174.104.22.30:443
142.117.191.18:2222
189.146.183.105:443
213.60.147.140:443
196.221.207.137:995
108.46.145.30:443
187.250.238.164:995
2.7.116.188:2222
195.43.173.70:443
106.250.150.98:443
45.67.231.247:443
83.110.103.152:443
83.110.9.71:2222
78.97.207.104:443
59.90.246.200:443
80.227.5.69:443
125.63.101.62:443
86.236.77.68:2222
109.106.69.138:2222
84.72.35.226:443
217.133.54.140:32100
197.161.154.132:443
89.137.211.239:995
74.222.204.82:995
122.148.156.131:995
156.223.110.23:443
144.139.166.18:443
202.185.166.181:443
76.94.200.148:995
71.63.120.101:443
196.151.252.84:443
202.188.138.162:443
Unpacked files
SH256 hash:
8df2692df2b95349c8d548433aefc56547f81fc040818fb67b3493d723906127
MD5 hash:
de8156bbac93c29b606c25c6724dfe86
SHA1 hash:
50446acb6b8604a5129aa1a13079de94cf8b2fd7
Link:
https://www.unpac.me/results/0db5500e-a4e9-481e-b0d5-87625a6530f3/
SH256 hash:
0d82df77582d5ea4c734ccac7c0c6559398e0ff942d8ce49772713b47667380b
MD5 hash:
e8f3bcb2560827a8aee38e739fe927af
SHA1 hash:
2468ca8a3ddf6c763b7e9378fc4676d90a3f5637
Link:
https://www.unpac.me/results/0db5500e-a4e9-481e-b0d5-87625a6530f3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0d82df77582d5ea4c734ccac7c0c6559398e0ff942d8ce49772713b47667380b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Squirrelwaffle

DLL dll 0d82df77582d5ea4c734ccac7c0c6559398e0ff942d8ce49772713b47667380b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1638309/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/191530/

Comments