Loading malware…
SquirrelWaffle is a Windows malware loader first observed in September 2021 and widely used in spam-driven initial access operations. It is primarily associated with large-scale malspam and thread-hijacking campaigns in which victims receive reply-chain phishing messages containing links to ZIP archives with malicious Microsoft Word or Excel documents. Word-based chains commonly rely on VBA macros that drop and run a VBScript downloader, while Excel-based chains have used Excel 4.0 macros to retrieve and execute the loader. The malware has also been linked to campaigns abusing compromised on-premises Microsoft Exchange servers, including activity involving ProxyLogon and ProxyShell, to send convincing malicious replies from legitimate accounts and bypass normal mail trust controls.
SquirrelWaffle functions chiefly as a delivery mechanism for follow-on payloads, most notably QakBot and Cobalt Strike. Its loader component has been documented as a DLL executed through living-off-the-land binaries including regsvr32.exe and rundll32.exe. Reverse-engineering analyses show that the malware gathers basic host metadata such as computer name, username, domain or workstation information, local network details, and user environment data, then transmits this information to command-and-control infrastructure using obfuscated HTTP POST traffic. The malware uses XOR- and Base64-based encoding for configuration and communications, and some samples include anti-analysis controls such as IP-based blocklists intended to avoid sandboxing and researcher visibility.
The loader supports multiple post-download execution paths. Depending on operator tasking, it can write and launch additional payloads, invoke regsvr32 for DLL execution, start executable files, or execute shellcode in memory. Analyses of its first-stage packer also show anti-analysis measures including custom rebasing logic, junk code padding, in-memory decryption of a second-stage PE, and remapping of the unpacked image into the current process. SquirrelWaffle has been associated with the malware distribution cluster commonly tracked as TR and has figured prominently in intrusion chains that later progressed to broader post-exploitation activity and, in some cases, ransomware operations via delivered tooling such as QakBot and Cobalt Strike.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The IIS logs showed that special crafted server-side request forgery (SSRF) requests were used to exploit CVE-2021-26855, directed at the Exchange Web Services API endpoint. This allowed the attacker to perform unauthorized actions on behalf of legitimate users. | Thus, it was affected by multiple vulnerabilities, e.g. “ProxyShell” (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and “ProxyLogon” (CVE-2021-26855). The IIS logs showed that special crafted server-side request forgery (SSRF) requests were used to exploit CVE-2021-26855, directed at the Exchange Web Services API endpoint. | Later it turned out that other organizations were affected by similar attacks, seemingly related to an attack campaign titled “squirrelwaffle”.
First, unpatched Exchange servers are exploited using ProxyShell... We have identified multiple cases of Exchange servers compromised with ProxyShell (chaining CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) in September and October. | We have identified multiple cases of Exchange servers compromised with ProxyShell (chaining CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) in September and October.
We have identified multiple cases of Exchange servers compromised with ProxyShell (chaining CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) in September and October.
We have identified multiple cases of Exchange servers compromised with ProxyShell (chaining CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) in September and October.
In late October CIRCL got notified about MS Exchange servers vulnerable for the recent critical Exchange RCE vulnerabilities CVE-2021-26427. Microsoft Exchange Server Remote Code Execution Vulnerability
Meanwhile, DEV-0464 distributes the “TR” Qakbot and other malware such as SquirrelWaffle. | DEV-0464 also rapidly adopted the Microsoft Support Diagnostic Tool (MSDT) vulnerability (CVE-2022-30190) in their campaigns.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TR has been associated with SquirrelWaffle and Qakbot campaigns but has recently been observed delivering IcedID.
The actors behind that campaign were believed to be 'TR', known to work with a plethora of malware, including Qbot, IcedID, and SquirrelWaffle.
Meanwhile, DEV-0464 distributes the “TR” Qakbot and other malware such as SquirrelWaffle.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
CVE-2021-26855: the pre-authentication proxy vulnerability This server-side request forgery (SSRF) vulnerability can allow a threat actor access by sending a specially crafted web request to an Exchange Server. | We observed evidence of the exploits on the vulnerabilities CVE-2021-26855, CVE-2021-34473, and CVE-2021-34523 in the IIS Logs on three of the Exchange servers that were compromised in different intrusions.
It turns out that the suspicious PowerShell execution is triggered via a scheduled task.
and a scheduled task launching PowerShell which in turn starts regsvr32.exe in the same way.
The obfuscated macros drop a VBS file, which downloads the SQUIRRELWAFFLE loader on the victim’s machine and executes it.
We found a suspicious PowerShell execution in an infected system... The PowerShell command is an example of a fileless technique wherein the actual command is stored in the registry.
Finally, it calls system to launch a start command and execute the dropped executable.
The malicious document contains macro code and a fake template that lures the victim to click on Enable Content. After the macros are executed, the malicious document acts as Dropper. It drops a VBS file stored inside the MalDoc to the disk and launches it via cscript command. | Once macros are enabled, the VBA executes (Command and Scripting Interpreter: Visual Basic: T1059.005) and executes the AutoOpen function.
The call to CreateThreadpoolWait registers the allocated buffer as a callback function to execute when the wait object completes. Finally, the call SetThreadpoolWait sets the wait object for the event, which executes the callback function and launches the shellcode.
The threat actors use a different technique to hide malicious code/strings such as URLs, IPs, commands, or even shellcode inside the malicious document.
The malicious macros v4 is executed and downloaded from a C2 server masquerading as DLL payloads.
AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.
After the Sleep action, the VBS script executes cmd.exe processes that swap a rundll32.exe which runs the following command: cmd /c rundll32.exe C:\ProgramData\www1.dll,ldr
the packer utilizes some interesting anti-analysis tricks... Step 2: Anti-Analysis Through Binary Padding
After getting the machine’s IP address, SQUIRRELWAFFLE checks to see if the decoded data contains the address. If it does, the malware exits immediately. From this, we know that the encoded buffer contains IP addresses to blacklist... This is typically used to check for IP addresses of sandboxes.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
SQUIRRELWAFFLE first generates a random name with a random length between 1 and 11, appends “.txt” to it... SQUIRRELWAFFLE also generates another random name for the executable, appends it after the machine’s TEMP path
the packer utilizes some interesting anti-analysis tricks... Step 2: Anti-Analysis Through Binary Padding
After getting the machine’s IP address, SQUIRRELWAFFLE checks to see if the decoded data contains the address. If it does, the malware exits immediately. From this, we know that the encoded buffer contains IP addresses to blacklist... This is typically used to check for IP addresses of sandboxes.
Traffic from a Squirrelwaffle loader infection filtered in Wireshark... Traffic filtered in Wireshark showing when Cobalt Strike activity started.
The final POST request is built in the format below. POST /<URL path>/<encoded endpoint path> HTTP/1.1\r\nHost: <URL>\r\nContent-Length:<encoded victim information length>\r\n\r\n<encoded victim information>
97 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
57 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Email-delivered malware distributed via malspam campaigns using malicious ZIP/Office documents with macros. It drops and executes VBS/XLM-based stages, downloads DLL modules from multiple URLs, enumerates the compromised host, and retrieves a next-stage payload identified as a Cobalt Strike beacon.
PrevPreviousA Virtual Baffle to Battle SquirrelWaffle
A malware loader distributed via malicious Office documents in spam campaigns. When a victim enables macros, a Visual Basic script downloads and executes follow-on payloads, providing attackers an initial foothold and a channel to deliver additional malware.
A malware loader delivered via malicious email ZIP archives and Word documents, leading to infection on Windows hosts.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.