MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Squirrelwaffle


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167
SHA3-384 hash: e4dc43163f6219b22555f62a9831636c3ca863390d708cc91b01fa35fe9536763b116ae6c4c3f90f4238d02268d862ec
SHA1 hash: 3bcb5e7bc9c317c3c067f36d7684a419da79506c
MD5 hash: e8ae3940c30296d494e534e0379f15d6
humanhash: stairway-high-carpet-quebec
File name:stage2.bin
Download: download sample
Signature Squirrelwaffle
Create hunting rule
File size:77'824 bytes
First seen:2021-10-01 04:26:03 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 928bcbb11c6089fb0e20b1939e328eec (1 x Squirrelwaffle)
ssdeep 1536:Qjt+4HqAkjU1o+C5AYklzXmSNWozYPO+LM8mynPufZUvh:Qjt+4rkw1oqrl8ocPOcxn2fm
Threatray 20 similar samples on MalwareBazaar
TLSH T1D5735B12BB11C0B1C59C1BB13166ABE642FE6C14AFF005C7BF960E2A58951E37C36F56
Reporter cPeterr
Tags:dll SQUIRRELWAFFLE

Intelligence

File Origin
# of uploads :
1
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Detection:
SquirrelWaffle
Create hunting rule
Link:
https://www.capesandbox.com/analysis/193843/
Result
Verdict:
Malware
Maliciousness:
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cda832f7-eb47-4462-9a09-4336bd64dce3
Result
Threat name:
Squirrelwaffle
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/862451
Signature
Performs DNS queries to domains with low reputation
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected Squirrelwaffle
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 494880 Sample: stage2.bin Startdate: 01/10/2021 Architecture: WINDOWS Score: 68 27 sinaloworx.co.za 2->27 29 vscm.in 2->29 31 3 other IPs or domains 2->31 63 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->63 65 Yara detected Squirrelwaffle 2->65 8 loaddll32.exe 1 2->8         started        signatures3 67 Performs DNS queries to domains with low reputation 27->67 process4 dnsIp5 45 vscm.in 8->45 47 apexbiotech.net 8->47 49 2 other IPs or domains 8->49 11 cmd.exe 1 8->11         started        13 rundll32.exe 8->13         started        17 iexplore.exe 1 73 8->17         started        19 2 other processes 8->19 process6 dnsIp7 21 rundll32.exe 11->21         started        51 vscm.in 13->51 53 trajesuniformes.com.br 13->53 55 sinaloworx.co.za 13->55 73 System process connects to network (likely due to code injection or exploit) 13->73 25 iexplore.exe 149 17->25         started        57 apexbiotech.net 184.154.46.111, 50079, 50080, 50081 SINGLEHOP-LLCUS United States 19->57 59 antoniocastroycia.com.co 107.180.50.210, 49748, 49750, 49752 AS-26496-GO-DADDY-COM-LLCUS United States 19->59 61 5 other IPs or domains 19->61 signatures8 process9 dnsIp10 33 trajesuniformes.com.br 191.252.106.237, 50580, 50582, 50585 LocawebServicosdeInternetSABR Brazil 21->33 35 dancongnghe.xyz 172.96.185.199, 50578, 50637, 50735 LEASEWEB-APAC-HKG-10LeasewebAsiaPacificpteltdHK Canada 21->35 41 4 other IPs or domains 21->41 69 System process connects to network (likely due to code injection or exploit) 21->69 71 Performs DNS queries to domains with low reputation 21->71 37 apexbiotech.net 25->37 39 edge.gycpi.b.yahoodns.net 87.248.118.23, 443, 49875, 49876 YAHOO-DEBDE United Kingdom 25->39 43 12 other IPs or domains 25->43 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167/
Threat name:
Win32.Downloader.Squirelwaffle
Create hunting rule
Status:
Malicious
First seen:
2021-10-01 04:26:12 UTC
AV detection:
19 of 45 (42.22%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=23fpmrmxxvpaqa7x2abu44yzl2b5vy3qiufc5cilql3xqvudaftq._file
Verdict:
malicious
Similar samples:
07c7cb49350bf3c6de4193fb2eeb8dd92d6662d60393ebd483a54bac80fb0b44
Squirrelwaffle
2a0a88a2e5f9cafa10a48d63bdfcdf965b72c25978ab46cf28e795dbedc9624a
Squirrelwaffle
3026fb99476bfb40357573b15fc63c0c63b1e9bd99f8266e91da21b80fe903cf
Squirrelwaffle
354f9844193171392a16a1a2262712d17638925f16aed9e9827f11e368e0fa05
Squirrelwaffle
4545b601c6d8a636dce6597da6443dce45d11b48fcf668336bcdf12ffdc3e97e
Squirrelwaffle
4f68558fb7a921b837926ca4e87fecba073f551a44c88109453a1a8099d003b6
Squirrelwaffle
5582447866948a38cb3d1013759854142cbbdc812de3d821c5d4c151e4ebbe6f
Squirrelwaffle
64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb
Squirrelwaffle
8c9fffe15dfde4a07bbedb2454fa34c413534eb7b3143e90d004a0b406a1914d
Squirrelwaffle
ff44d683718a65333d448a513cb65905a41c526df81a75cdfb71f5335ea5d811
Squirrelwaffle
+ 10 additional samples on MalwareBazaar
Result
Malware family:
squirrelwaffle
Create hunting rule
Score:
  10/10
Tags:
family:squirrelwaffle suricata
Link:
https://tria.ge/reports/211001-e2kmjsahdl/
Behaviour
Suspicious use of WriteProcessMemory
suricata: ET MALWARE Possible SQUIRRELWAFFLE Server Response
suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)
suricata: ET MALWARE SQUIRRELWAFFLE Server Response
Malware Config
C2 Extraction:
pop.vicamtaynam.com/VtyiHAft
snsvidyapeeth.in/aXmo2Dr3
trinitytesttubebaby.com/QR2JvfE3Sv
iconskw.com/cqdPtAbZ
ebookchuyennganh.com/v9PMvQDxHK8W
alsader.net/BHdQaiQ9rt
avyanshglobal.com/6pYjPlqf
primahills-online.com/ypCiZn7tMx
antoniocastroycia.com.co/WHe08obY
apexbiotech.net/VQgunQ4t5Ue
vscm.in/V3tYKxDz
sinaloworx.co.za/3GilA8Eo3r
dancongnghe.xyz/yRByhX6J3REI
trajesuniformes.com.br/qQofZMaJm
fiorenzapaes.com.br/PGYpETW7
astetinternational.com/arW5e44Y7vzO
razisystem.ir/MqvvkX0cWvn
krishnaiti.org.in/rWA02HQY4
Unpacked files
SH256 hash:
d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167
MD5 hash:
e8ae3940c30296d494e534e0379f15d6
SHA1 hash:
3bcb5e7bc9c317c3c067f36d7684a419da79506c
Link:
https://www.unpac.me/results/7412c12b-60a2-4f23-9134-3cc2bb6bed79/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Windows_Loader_SquirrelWaffle
Create hunting rule
Description:Identifies strings/byte sequence used in unpacked SquirrelWaffle loader
Rule name:Windows_Loader_SquirrelWaffle
Create hunting rule
Description:Identifies strings/byte sequence used in unpacked SquirrelWaffle loader
Rule name:win_squirrelwaffle_loader
Create hunting rule
Author:Rony(@r0ny_123)
Description:Detects unpacked squirrelwaffle loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Squirrelwaffle

DLL dll 4545b601c6d8a636dce6597da6443dce45d11b48fcf668336bcdf12ffdc3e97e

Squirrelwaffle

DLL dll d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167

(this sample)

  
Dropped by
SHA256 4545b601c6d8a636dce6597da6443dce45d11b48fcf668336bcdf12ffdc3e97e
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/193843/

Comments