MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5582447866948a38cb3d1013759854142cbbdc812de3d821c5d4c151e4ebbe6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Squirrelwaffle
Vendor detections: 5
| SHA256 hash: | 5582447866948a38cb3d1013759854142cbbdc812de3d821c5d4c151e4ebbe6f |
|---|---|
| SHA3-384 hash: | 602d19a49742820c95fa1d7912e12873d4e4111a3e5b42aaaebd95ba075bee8cd2e3c8dc71dac9a599a246471a55fe53 |
| SHA1 hash: | 4a1e34488f21c336599dc7b576bdfda066f98522 |
| MD5 hash: | 6373e3b1950d7529d63262ebc9c76ea9 |
| humanhash: | papa-hamper-yellow-hotel |
| File name: | 5582447866948a38cb3d1013759854142cbbdc812de3d821c5d4c151e4ebbe6f |
| Download: | download sample |
| Signature | Squirrelwaffle |
| File size: | 266'752 bytes |
| First seen: | 2021-09-21 15:57:15 UTC |
| Last seen: | 2021-09-21 17:02:50 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 6ab39574820a2a48b54bd7f4c3fe61dc (1 x Squirrelwaffle) |
| ssdeep | 1536:tK4+iZammcvDYpYV8ZQ0BPeLcYFS5ZocmBh1ljiZKlBXTTEHs2nlWUU5B+opdTmk:immADHV8Zh1ekCl1lhBUBp1QKHKH9 |
| Threatray | 13 similar samples on MalwareBazaar |
| TLSH | T1464419B8BF92CD54E0594AF482B28F60CE6657483D25CCDB92F9E9EC5A797C0780B143 |
| File icon (PE): |  |
| dhash icon | cad25aa896aa94c4 (1 x Squirrelwaffle) |
| Reporter |  malwarelabnet |
| Tags: | dll SQUIRRELWAFFLE |
Intelligence
File Origin
# of uploads :
2
# of downloads :
315
Origin country :
n/a
Vendor Threat Intelligence
Detection:
SquirrelWaffle
Verdict:
Unknown
Result
Threat name:
Squirrelwaffle
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Signature
PE file has nameless sections
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected Squirrelwaffle
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.GenericML
Status:
Malicious
First seen:
2021-09-21 15:58:13 UTC
AV detection:
17 of 45 (37.78%)
Threat level:
5/5
Verdict:
unknown
Similar samples:
+ 3 additional samples on MalwareBazaar
Result
Malware family:
squirrelwaffle
Score:
10/10
Tags:
family:squirrelwaffle downloader
Behaviour
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
squirrelwaffle
SquirrelWaffle is a simple downloader written in C++.
Malware Config
C2 Extraction:
deanandwilconstruction.com/UXEvfuIlhws
arimeto.lv/Nm70oAfwB
gitamschool.com/oZbs0Oqw7uv
eresourcesmoneymarket.com/JbVwdgaV6l
flyershipmanager.com/SGAsORYsywt
arimeto.lv/Nm70oAfwB
gitamschool.com/oZbs0Oqw7uv
eresourcesmoneymarket.com/JbVwdgaV6l
flyershipmanager.com/SGAsORYsywt
Unpacked files
SH256 hash:
b0441bc63773e1719aac9acbd99f6e72bdd31017038e5e26af2646bef8c974f3
MD5 hash:
e58e26b525a717c0f140fd3c56b768ad
SHA1 hash:
b8222a45ce2f24d098f0de9745a8852c66879888
SH256 hash:
5582447866948a38cb3d1013759854142cbbdc812de3d821c5d4c151e4ebbe6f
MD5 hash:
6373e3b1950d7529d63262ebc9c76ea9
SHA1 hash:
4a1e34488f21c336599dc7b576bdfda066f98522
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.