0278a0ff3a6fc56294995c86444bba7f264b945ed29e91d62e9256157ce6d15e.dll

Classification: Malicious

0278a0ff3a6fc56294995c86444bba7f264b945ed29e91d62e9256157ce6d15e.dll is a malicious file sample. Linked to Squirrelwaffle malware.

Detection summary

  • 95 antivirus detections (63% detection ratio)
  • 0 IDS alerts
  • 2 processes observed
  • 4 contacted hosts
  • 4 DNS requests

MITRE ATT&CK associations

Malware families: SQUIRRELWAFFLE (S1030)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Squirrelwaffle Abuse.ch 2021-10-27 10:31:13 2021-10-27 10:31:13 malicious-activity S1030 Squirrelwaffle

Sample information

Filenames
0278a0ff3a6fc56294995c86444bba7f264b945ed29e91d62e9256157ce6d15e.dll, test1.test.dll
File type
application/x-dosexec
Size
458218 bytes
MD5
7df7e578e914d992be61f8057adc25cd
SHA-1
1fe5e1eaf8ab95478635664ee2141dbe52e5a5e8
SHA-256
0278a0ff3a6fc56294995c86444bba7f264b945ed29e91d62e9256157ce6d15e
First indexed
2021-10-27 07:17:46
Last updated
2026-03-03 06:07:48

Antivirus detections

EngineDetection
LionicTrojan.Win32.Malicious.4!c
Elasticmalicious (high confidence)
DrWebTrojan.DownLoader43.22421
MicroWorld-eScanTrojan.Generic.30185270
FireEyeGeneric.mg.7df7e578e914d992
McAfeeGenericRXAA-AA!7DF7E578E914
CylanceUnsafe
ZillyaDownloader.Agent.Win32.449545
SangforVirus.Win32.Save.a
CrowdStrikewin/malicious_confidence_90% (W)
AlibabaTrojanDownloader:Win32/Qakbot.9a3c205e
K7GWTrojan-Downloader ( 005825f01 )
K7AntiVirusTrojan-Downloader ( 005825f01 )
ArcabitTrojan.Generic.D1CC9736
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/TrojanDownloader.Agent.FWT
APEXMalicious
BitDefenderTrojan.Generic.30185270
NANO-AntivirusTrojan.Win32.Delphi.fewgku
AvastWin32:Trojan-gen
Ad-AwareTrojan.Generic.30185270
EmsisoftTrojan.Generic.30185270 (B)
McAfee-GW-EditionArtemis!Trojan
SophosMal/EncPk-APY
SentinelOneStatic AI - Malicious PE
MaxSecureTrojan.Malware.122357445.susgen
AviraTR/YAV.Minerva.pzitl
GridinsoftTrojan.Win32.Downloader.oa!s1
MicrosoftTrojan:Win32/Qakbot.SM!MTB
ViRobotTrojan.Win32.Z.Agent.458218
GDataWin32.Trojan.PSE.11UBQ5E
CynetMalicious (score: 99)
AhnLab-V3Trojan/Win.Qakbot.R442762
ALYacTrojan.Generic.30185270
MAXmalware (ai score=88)
VBA32BScope.TrojanDownloader.Deyma
MalwarebytesMalware.AI.536830020
TrendMicro-HouseCallTROJ_GEN.R002C0DIT21
YandexTrojan.DL.Agent!B9q93vzme+0
IkarusTrojan.Win32.Generic
FortinetW32/Injector.EQDN!tr
AVGWin32:Trojan-gen
PandaTrj/GdSda.A
AlibabaTrojanDownloader:Win32/Qakbot.7b4ff486
CyrenW32/Kryptik.FQB.gen!Eldorado
KasperskyHEUR:Trojan.Win32.Qshell.pef
TencentMalware.Win32.Gencirc.11d0eb3c
SophosMal/Generic-R + Mal/EncPk-APY
KingsoftWin32.Troj.Undef.(kcloud)
ZoneAlarmHEUR:Trojan.Win32.Qshell.pef
CynetMalicious (score: 100)
IkarusTrojan.Win32.Injector
ALYacGen:Variant.Zusy.405600
AVGWin32:Evo-gen [Trj]
AlibabaTrojanDownloader:Win32/Qakbot.7ddb4ab3
Antiy-AVLTrojan/Win32.Kryptik
ArcabitTrojan.Zusy.D63060
AvastWin32:Evo-gen [Trj]
AviraHEUR/AGEN.1368173
BitDefenderGen:Variant.Zusy.405600
BkavW32.AIDetectMalware
CAT-QuickHealTrojan.QakbotIH.S24673104
CTXdll.trojan.generic
ClamAVWin.Malware.Barys-9917903-0
CrowdStrikewin/malicious_confidence_100% (W)
ESET-NOD32Win32/TrojanDownloader.Agent.FWT trojan
EmsisoftGen:Variant.Zusy.405600 (B)
F-SecureHeuristic.HEUR/AGEN.1368173
FortinetW32/Injector.A!tr
GDataGen:Variant.Zusy.405600
GoogleDetected
IkarusTrojan.Win32.Krypt
K7AntiVirusTrojan-Downloader ( 005fec881 )
K7GWTrojan-Downloader ( 005fec881 )
Kingsoftmalware.kb.a.980
LionicTrojan.Win32.Qakbot.4!c
MalwarebytesInject.Exploit.Shellcode.DDS
McAfeeDti!0278A0FF3A6F
MicroWorld-eScanGen:Variant.Zusy.405600
Paloaltogeneric.ml
RisingDownloader.Agent!8.B23 (TFE:5:W6FBAXqIPYF)
SangforDownloader.Win32.Qakbot.Vt4p
SentinelOneStatic AI - Suspicious PE
SymantecTrojan Horse
TencentMalware.Win32.Gencirc.10bbb4ce
Trapminemalicious.moderate.ml.score
TrellixENSGenericRXRH-CO!7DF7E578E914
VIPREGen:Variant.Zusy.405600
VaristW32/Kryptik.FQB.gen!Eldorado
WebrootW32.Trojan.Squirrelwaffle
XcitiumMalware@#27ugtn8b35o7z
ZoneAlarmMal/EncPk-APY
alibabacloudTrojan[downloader]:Win/Qakbot.SZ8PHU
huorongTrojan/Injector.akr
tehtrisGeneric.Malware

Network contacts

143.95.83.72 210.18.139.106 74.220.194.185 88.99.53.105

DNS requests

deanandwilconstruction.com eresourcesmoneymarket.com flyershipmanager.com gitamschool.com

Process list

NameCommand line
<Ignored Process>
regsvr32.exe/s "C:\0278a0ff3a6fc56294995c86444bba7f264b945ed29e91d62e9256157ce6d15e.dll"