MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3026fb99476bfb40357573b15fc63c0c63b1e9bd99f8266e91da21b80fe903cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Squirrelwaffle
Vendor detections: 4
| SHA256 hash: | 3026fb99476bfb40357573b15fc63c0c63b1e9bd99f8266e91da21b80fe903cf |
|---|---|
| SHA3-384 hash: | f15e51821ed9bc9536dac7877a41104cc4e4eb808aed1743287c97f9039395ae59276babf523f5a380a1640e7e2a032f |
| SHA1 hash: | 4ad69a31a65172cdcaa6e3ea1afad7b4e30b88d9 |
| MD5 hash: | 69c9b5e0c3e6346f468ed148fc318529 |
| humanhash: | twenty-comet-pip-wisconsin |
| File name: | test.test |
| Download: | download sample |
| Signature | Squirrelwaffle |
| File size: | 255'133 bytes |
| First seen: | 2021-09-20 11:44:54 UTC |
| Last seen: | 2021-09-20 13:01:16 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | ae58eccde50cf13d31ec71d58a5eb86c (1 x Squirrelwaffle) |
| ssdeep | 3072:x4F3joUMzh1nR9SSvAnmbkym+3j0SuS9fy8fL+g1Eh4dLB5I0cGFiY8QqC2:VhI4A9C9yZJpOixQq |
| Threatray | 13 similar samples on MalwareBazaar |
| TLSH | T1A2446F7DBAEEE1B6E5814578207A3EF157F60D30D8006461ED8CFDE82570DE2ABA0617 |
| File icon (PE): |  |
| dhash icon | 10808a8c8c8a8010 (77 x Formbook, 51 x AgentTesla, 44 x RemcosRAT) |
| Reporter |  ffforward |
| Tags: | dll SQUIRRELWAFFLE test tr |
Intelligence
File Origin
# of uploads :
2
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Verdict:
Malicious
Result
Threat name:
Squirrelwaffle
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected Squirrelwaffle
Behaviour
Behavior Graph:
Threat name:
Win32.Infostealer.Aicat
Status:
Malicious
First seen:
2021-09-20 11:45:12 UTC
AV detection:
21 of 45 (46.67%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 3 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Unpacked files
SH256 hash:
97539064d2044fd3992a628ad1ae3616ff11121e45d71441509f54c4fc07b552
MD5 hash:
237d35334838795d556c1ec37807f30c
SHA1 hash:
834b3f4beafa31f14e9c192646239cfa7bf88d06
SH256 hash:
3026fb99476bfb40357573b15fc63c0c63b1e9bd99f8266e91da21b80fe903cf
MD5 hash:
69c9b5e0c3e6346f468ed148fc318529
SHA1 hash:
4ad69a31a65172cdcaa6e3ea1afad7b4e30b88d9
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.