Procedure examples

Squirrelwaffle has collected the victim’s external IP address.

Squirrelwaffle has been packed with a custom packer to hide payloads.

Squirrelwaffle has been obfuscated with a XOR-based algorithm.

Squirrelwaffle can collect the user name from a compromised host.

Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.

Squirrelwaffle has used PowerShell to execute its payload.

Squirrelwaffle has used `cmd.exe` for execution.

Squirrelwaffle has used malicious VBA macros in Microsoft Word documents and Excel spreadsheets that execute an `AutoOpen` subroutine.

Squirrelwaffle has used HTTP POST requests for C2 communications.

Squirrelwaffle has gathered victim computer information and configurations.

Squirrelwaffle has downloaded and executed additional encoded payloads.

Squirrelwaffle has encoded its communications to C2 servers using Base64.

Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.

Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns.

Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.

Squirrelwaffle has been executed using `regsvr32.exe`.

Squirrelwaffle has been executed using `rundll32.exe`.

Squirrelwaffle has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.

Squirrelwaffle has encrypted collected data using a XOR-based algorithm.

Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.

Squirrelwaffle has been distributed through phishing emails containing a malicious URL.