<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin-top: 0px; margin-bottom: 0px;">Hello,
<div><br>
</div>
<div>I hope everyone is doing well!</div>
<div><br>
</div>
<div>Below is the entry for today.</div>
<div><br>
</div>
<div>10/27/2021 - Diary entry #378:</div>
<div><br>
</div>
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<p>Squirrelwaffle is a threat being spread via spam campaigns, since September 2021, to deliver malicious Microsoft Office documents (maldocs). These spam campaigns leverage stolen email threads with links to malicious ZIP artifacts containing a maldoc with
the DOC or XLS formats. The language used in the campaigns is led by English with 76%, followed by French, German, Dutch, and Polish.</p>
<p><br>
</p>
<p>As soon as they infect the system, whether being executed by rundll32.exe or regsvr32.exe (two native Windows binaries), Squirrelwaffle is used to deliver Qakbot or Cobalt Strike. Covered in many of our Daily Diaries, Qakbot is a well-known banking trojan,
and Cobalt Strike is a penetration-testing tool commonly used during attacks, including Solar Winds' incident covered in many of our Daily Diaries. However, Squirrelwaflle loader can be used to remotely deploy other secondary malicious payloads sent by the
attacker.</p>
<p><br>
</p>
<p>Although Squirrelwaffle is new, it reveals an interesting structure to deploy multi-purpose threats, similar to others such as IceID (covered in Daily Diary #240), which took place after the Emotet disruption - also used as backdoor/botnet to load other
types of malware.</p>
</blockquote>
<p><br>
</p>
<div style="margin-top: 0px; margin-bottom: 0px;"><span></span><br>
Kind Regards,<br>
</div>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>Felipe Tarijon de Almeida</strong><br>
Malware Analyst<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a href="mailto:felipe.tarijon@appgate.com" title="mailto:felipe.tarijon@appgate.com">
felipe.tarijon@appgate.com</a></span><br>
O:<span> </span><span style="margin:0px; background-color:white">+55 11 97467 9549</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>