MalwareUsed by 1 actor

SquirtDanger

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TheBottle

we began by investigating a new malware family, which we are calling SquirtDanger based on a DLL, SquirtDanger.dll, used in the attacks.

via paloalto researchcenter historicresearchcenter.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

Additionally, in the wild, we were able to identify 52 unique IP's or domains acting as delivery infrastructure. This infrastructure acts as a dissemination point for this malware. Some of this delivery infrastructure appeared to be compromised legitimate websites unwittingly distributing SquirtDanger.

T1566PhishingEvidence1

SquirtDanger is likely delivered via illicit software downloads also known as "Warez".

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

Once run on the system, it will persist via a scheduled task that is set to run every minute.

T1059Command and Scripting InterpreterEvidence1

The malware is written in C# (C Sharp) and has multiple layers of embedded code.

T1204.002Malicious FileEvidence1

SquirtDanger is likely delivered via illicit software downloads also known as "Warez".

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

Once run on the system, it will persist via a scheduled task that is set to run every minute.

T1543Create or Modify System ProcessEvidence1

This simple executable will simply check for the existence of the SquirtDanger payload, and if the payload cannot be found, a new copy is written to disk and a new instance will be spawned.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

Once run on the system, it will persist via a scheduled task that is set to run every minute.

T1543Create or Modify System ProcessEvidence1

This simple executable will simply check for the existence of the SquirtDanger payload, and if the payload cannot be found, a new copy is written to disk and a new instance will be spawned.

Stealth

3 techniques

T1218System Binary Proxy ExecutionEvidence1

This executable is embedded within the SquirtDanger payload, and has been observed dropped to the following location: %TEMP%\MSBuild.exe

T1497.001System ChecksEvidence1

Once the installation phase has completed and the malware is found to be executed from the correct location, a new mutex will be created to ensure only one instance of the malware is run at a given time.

T1564Hide ArtifactsEvidence1

This dropped file is given both SYSTEM and HIDDEN attributes to prevent victims from discovering it.

Credential Access

1 technique

T1555Credentials from Password StoresEvidence1

In the case of stealing passwords from browsers, a number of browsers are supported, including the following: Chrome Firefox Yandex Browser Kometa Amigo Torch Opera

Discovery

3 techniques

T1057Process DiscoveryEvidence1

SquirtDanger comes with a wealth of functionality, including the following: ... List processes

T1083File and Directory DiscoveryEvidence1

SquirtDanger comes with a wealth of functionality, including the following: ... List drives Get directory information

T1497.001System ChecksEvidence1

Collection

2 techniques

T1113Screen CaptureEvidence1

SquirtDanger comes with a wealth of functionality, including the following: Take screenshots

T1115Clipboard DataEvidence1

In addition to stealing wallets, the malware contains the ability to swap a victim’s clipboard data in the event a specific regular expression is encountered.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

SquirtDanger uses raw TCP connections to a remote command and control (C2) server for network communications.

T1105Ingress Tool TransferEvidence1

When the malware initially communicates with the remote server, it will attempt to obtain a list of additional modules to install... After the list of modules and their associated URLs are collected, SquirtDanger will download these modules via HTTP communication.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

SquirtDanger uses raw TCP connections to a remote command and control (C2) server for network communications.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

paloalto researchcenter historicNews

Apr 17, 2018

SquirtDanger: The Swiss Army Knife Malware from Veteran Malware Author TheBottle

Commodity botnet malware written in C# that persists via scheduled task, communicates with a C2 over raw TCP, and supports screenshots, file operations, process management, browser password theft, cryptocurrency wallet theft, clipboard wallet swapping, and execution of additional files/modules.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

SquirtDanger

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TheBottle

we began by investigating a new malware family, which we are calling SquirtDanger based on a DLL, SquirtDanger.dll, used in the attacks.

via paloalto researchcenter historicresearchcenter.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

T1566PhishingEvidence1

SquirtDanger is likely delivered via illicit software downloads also known as "Warez".

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

Once run on the system, it will persist via a scheduled task that is set to run every minute.

T1059Command and Scripting InterpreterEvidence1

The malware is written in C# (C Sharp) and has multiple layers of embedded code.

T1204.002Malicious FileEvidence1

SquirtDanger is likely delivered via illicit software downloads also known as "Warez".

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

Once run on the system, it will persist via a scheduled task that is set to run every minute.

T1543Create or Modify System ProcessEvidence1

This simple executable will simply check for the existence of the SquirtDanger payload, and if the payload cannot be found, a new copy is written to disk and a new instance will be spawned.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

Once run on the system, it will persist via a scheduled task that is set to run every minute.

T1543Create or Modify System ProcessEvidence1

This simple executable will simply check for the existence of the SquirtDanger payload, and if the payload cannot be found, a new copy is written to disk and a new instance will be spawned.

Stealth

3 techniques

T1218System Binary Proxy ExecutionEvidence1

This executable is embedded within the SquirtDanger payload, and has been observed dropped to the following location: %TEMP%\MSBuild.exe

T1497.001System ChecksEvidence1

T1564Hide ArtifactsEvidence1

This dropped file is given both SYSTEM and HIDDEN attributes to prevent victims from discovering it.

Credential Access

1 technique

T1555Credentials from Password StoresEvidence1

In the case of stealing passwords from browsers, a number of browsers are supported, including the following: Chrome Firefox Yandex Browser Kometa Amigo Torch Opera

Discovery

3 techniques

T1057Process DiscoveryEvidence1

SquirtDanger comes with a wealth of functionality, including the following: ... List processes

T1083File and Directory DiscoveryEvidence1

SquirtDanger comes with a wealth of functionality, including the following: ... List drives Get directory information

T1497.001System ChecksEvidence1

Collection

2 techniques

T1113Screen CaptureEvidence1

SquirtDanger comes with a wealth of functionality, including the following: Take screenshots

T1115Clipboard DataEvidence1

In addition to stealing wallets, the malware contains the ability to swap a victim’s clipboard data in the event a specific regular expression is encountered.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

SquirtDanger uses raw TCP connections to a remote command and control (C2) server for network communications.

T1105Ingress Tool TransferEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

SquirtDanger uses raw TCP connections to a remote command and control (C2) server for network communications.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

paloalto researchcenter historicNews

Apr 17, 2018

SquirtDanger: The Swiss Army Knife Malware from Veteran Malware Author TheBottle

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.