MITRE ATT&CKsoftware (malware)
S1030 Squirrelwaffle
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2022-08-09
Description
Squirrelwaffle is a loader that was first seen in September 2021. It has been used in spam email campaigns to deliver additional malware such as Cobalt Strike and the QakBot banking trojan.
Related
Uses · MITRE ATT&CK (21)
- T1027.013 Encrypted/Encoded File sub-technique
- T1071.001 Web Protocols sub-technique
- T1132.001 Standard Encoding sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1560.003 Archive via Custom Method sub-technique
- T1027.002 Software Packing sub-technique
- T1218.010 Regsvr32 sub-technique
- T1218.011 Rundll32 sub-technique
- T1497 Virtualization/Sandbox Evasion technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1016 System Network Configuration Discovery technique
- T1033 System Owner/User Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1082 System Information Discovery technique
- T1105 Ingress Tool Transfer technique
References
- https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike ZScaler Squirrelwaffle Sep 2021
- https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot Netskope Squirrelwaffle Oct 2021