“Squirrelwaffle” Maldoc Analysis

“Squirrelwaffle” Maldoc Analysis

Summary Squirrelwaffle is an emerging malware threat noted by several security researchers beginning around September 13th. TheAnalyst, @ffforward noted a new payload delivered on the “TR” botnet. Brad Duncan at Malware Traffic Analysis also observed that this new loader was being delivered by the same “TR” infrastructure that historically delivered the Qakbot banking trojan. He…

The United States Cybersecurity Mission: A Policy Review and Assessment of Leadership Roles

The United States Cybersecurity Mission: A Policy Review and Assessment of Leadership Roles

Disclaimer: The following is a paper I wrote many years ago as an inexperienced and (somewhat) young person interested in security. I’ve decided to share it here based on the policy discussions raised during the recent Senate Intelligence Committee hearing on the Solar Winds incident. tl;dr My main thesis was that the overall security posture…

Quick Post: Mummy Spider Delivers Emotet Maldocs for the Holidays

Quick Post: Mummy Spider Delivers Emotet Maldocs for the Holidays

Emotet is a modular malware delivery platform that has consistently dominated the commodity malware threat landscape over the past couple of years. It has evolved from a straightforward banking trojan into a full-fledged malware distribution service, delivering a variety of payloads for other threat actor groups. The U.S. Department of Homeland Security states that Emotet infections cost state…

New Obfuscation Techniques in Emotet Maldocs

New Obfuscation Techniques in Emotet Maldocs

Summary Emotet is a modular malware delivery platform that has consistently dominated the commodity malware threat landscape over the past couple of years. It has evolved from a straightforward banking trojan into a full-fledged malware distribution service, delivering a variety of payloads for other threat actor groups. The U.S. Department of Homeland Security states that Emotet infections…

Quick Post: Analyzing Maldoc with “Do While” Loop in VBA Downloader

Quick Post: Analyzing Maldoc with “Do While” Loop in VBA Downloader

Summary Emotet is a modular malware delivery platform that has consistently dominated the commodity malware threat landscape over the past couple of years. It has evolved from a straightforward banking trojan into a full-fledged malware distribution service, delivering a variety of payloads for other threat actor groups. The U.S. Department of Homeland Security states that…

Analysis of a New Emotet Maldoc with VBA Downloader

Analysis of a New Emotet Maldoc with VBA Downloader

Summary Emotet is a modular delivery platform that has consistently dominated the commodity malware threat landscape over the past couple of years. It has evolved from a straightforward banking trojan into a full-fledged malware distribution service, delivering a variety of payloads for other threat actor groups. The U.S. Department of Homeland Security states that Emotet…

A Quick Look at Emotet’s Updated JavaScript Dropper

A Quick Look at Emotet’s Updated JavaScript Dropper

Summary Emotet is an advanced, modular downloader that primarily functions as a dropper of other opportunistic malware variants. Emotet continues to be among the most widely distributed and destructive malware variants affecting organizations throughout the private and public sectors. In a previous joint Technical Alert, US-CERT identified that Emotet infections have cost organizations up to…