MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 354f9844193171392a16a1a2262712d17638925f16aed9e9827f11e368e0fa05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Squirrelwaffle


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 354f9844193171392a16a1a2262712d17638925f16aed9e9827f11e368e0fa05
SHA3-384 hash: 08a13e554a041e833d7ebc148de8a9aa6a005580b1fcee63b204ddbe06bd9926054f36531481049810f699282cecea6f
SHA1 hash: 4d41dd344d23aaba495fcd84e687d1d18db9fdd0
MD5 hash: 0455195030f395efd863a6ae9c5acbf6
humanhash: single-yellow-asparagus-leopard
File name:www2.dll
Download: download sample
Signature Squirrelwaffle
Create hunting rule
File size:259'765 bytes
First seen:2021-09-20 08:21:32 UTC
Last seen:2021-09-20 09:01:16 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 1b8854882478e8ab7439d9dedeec9966 (2 x Squirrelwaffle, 1 x Gozi)
ssdeep 6144:pSYWZLzPgBi8L1UVdRU/MGRulllll/llllleI9ntib/xMSMi:pbQcUNtGRulllll/lllllo/ySMi
Threatray 2'056 similar samples on MalwareBazaar
TLSH T17C44AE0ABEC7DC32CC3D08788861D9E2663C78565A60C9A33B953F3F5DB71C149259AE
Reporter lobster9000
Tags:dll SQUIRRELWAFFLE

Intelligence

File Origin
# of uploads :
3
# of downloads :
184
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Squirrelwaffle
Create hunting rule
Link:
https://www.capesandbox.com/analysis/189357/
Detection(s):
SecuriteInfo.com.Variant.Midie.98898.17255.15162.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b1a1799f-d16b-4465-bc4f-9518652bdfa8
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/853835
Signature
Antivirus detection for URL or domain
Machine Learning detection for sample
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/354f9844193171392a16a1a2262712d17638925f16aed9e9827f11e368e0fa05/
Threat name:
Win32.Worm.Cridex
Create hunting rule
Status:
Malicious
First seen:
2021-09-20 08:22:12 UTC
AV detection:
12 of 45 (26.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gvhzqrazgfytskqwugrcmjys2f3dres7c2xnt2mcp4i6g2ha7icq._file
Verdict:
malicious
Label(s):
gozi
Create hunting rule
Similar samples:
00d045c89934c776a70318a36655dcdd77e1fedae0d33c98e301723f323f234c
Squirrelwaffle
054ff4620aaa40928ca67a2c364bedf71d79672874d75ba50ff8231069ad74d9
Squirrelwaffle
0cf7c00b406b33ae2af9068885a9d3c1ba3993f3878aa06e052c3b0249a42d81
Squirrelwaffle
30b6438b14eac5337f6d0f81997a4fce356611fc19155ae3650d5df21e894e74
Squirrelwaffle
48df40524456a981de9356a9b89ecfded629e931b85e9f8519effb9d4079379c
Squirrelwaffle
85d0b72fe822fd6c22827b4da1917d2c1f2d9faa838e003e78e533384ea80939
Squirrelwaffle
96b51e628389b4044eb4c4d262deadbcfa778db13a7768ab7806b0e1f81d2ebf
Squirrelwaffle
b5bca2548051f7a0bccedd44ae018dfe9df7632ecb9c7c7ff98a6aadecc985b3
Squirrelwaffle
b6bd8479ef5943eaf26efdcda11ab09bf0569ad2295ba905fc0901511ca7c286
Squirrelwaffle
de81f923ca4c12378688a8e26fbb0ec11d69d35f509cff7815fd3d4bc9bb0f59
Squirrelwaffle
+ 2'046 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210920-j9kpqsgahp/
Behaviour
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Unpacked files
SH256 hash:
ee43602a0c3ecf0bed34978ae396db9fbc75f9d432bd36994fd45c37f787cf1c
MD5 hash:
8271bddae0c3d77f195ab2096f2a971f
SHA1 hash:
4dd3b77280315adc589f45fc4cf161b7237b56d2
Link:
https://www.unpac.me/results/f326154f-8b5d-4ace-ab72-3530bd7a708f/
SH256 hash:
354f9844193171392a16a1a2262712d17638925f16aed9e9827f11e368e0fa05
MD5 hash:
0455195030f395efd863a6ae9c5acbf6
SHA1 hash:
4d41dd344d23aaba495fcd84e687d1d18db9fdd0
Link:
https://www.unpac.me/results/f326154f-8b5d-4ace-ab72-3530bd7a708f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/354f9844193171392a16a1a2262712d17638925f16aed9e9827f11e368e0fa05

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_squirrelwaffle_loader
Create hunting rule
Author:Rony(@r0ny_123)
Description:Detects unpacked squirrelwaffle loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Squirrelwaffle

DLL dll 354f9844193171392a16a1a2262712d17638925f16aed9e9827f11e368e0fa05

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/189357/

Comments