Squirrelwaffle malware used to drop Cobalt Strike
A new malware threat named Squirrelwaffle has emerged in the wild, which is used by threat actors to gain an initial foothold and a way to drop malware onto compromised systems and networks.
The new malware tool spreads via spam campaigns dropping Qakbot and Cobalt Strike in the most recent campaigns.
Squirrelwaffle malware was discovered by researchers at Cisco Talos. It is one of the tools that emerged as an Emotet replacement shortly after the law enforcement disruption on the widely used botnet.
The new threat first emerged in September 2021, with increased distribution volumes by the month end. The spam campaign primarily uses stolen reply-chain email campaigns in English, but the threat actors also utilize French, German, Dutch, and Polish emails.
These emails contain hyperlinks to malicious ZIP archives hosted on attacker-controlled web servers and typically include a malicious .doc or a .xls attachment that runs malware-retrieving code if opened.
Talos researchers sampled and analyzed several documents and found that the actors use the DocuSign signing platform as bait to trick the recipients into enabling macros on their MS Office suite.
The contained code leverages string reversal for obfuscation, writes a VBS script to %PROGRAMDATA%, and executes it.
This action fetches Squirrelwaffle from one of the five hardcoded URLs, delivering it in the form of a DLL file onto the compromised system.
The Squirrelwaffle loader then deploys malware like Qakbot or the widely abused penetration testing tool Cobalt Strike.
Cobalt Strike is a legitimate penetration testing tool designed as an attack framework to test an organization’s infrastructure to discover security gaps and vulnerabilities.
But the threat actors use cracked versions of Cobalt Strike for post-exploitation tasks after deploying beacons, which provide them with persistent remote access to compromised devices.
Squirrelwaffle also features an IP blocklist that is populated with notable security research firms as a way to evade detection and analysis.
All communications between Squirrelwaffle and the C2 infrastructure are encrypted (XOR+Base64) and sent via HTTP POST requests.
The threat actors leverage previously compromised web servers to support the file distribution aspect of their operations, with most of these sites running WordPress 5.8.1.
Squirrelwaffle may be a reboot of Emotet by members who dodged law enforcement or other threat actors attempting to fill the void left behind by the notorious malware.
Due to its increasing utilization, Cisco Talos advises all organizations and security professionals to become aware of the tactics used in this malware’s campaigns.
Image Credits : Talos Blog
The post Squirrelwaffle malware used to drop Cobalt Strike first appeared on Cybersafe News.
