This tricks the user and makes them believe it is a document file.

If the user has not allowed viewing of file extensions in their operating system folder options, the sample would be displayed as “NF-eletronica-8457348947.Docx” without the. Jelastic redirects to the CloudApp cloud platform which in turn uses Amazon AWS for its backend cloud services as shown in Figure 1.įigure 1: CloudSquirrel delivery mechanism The delivery mechanism of CloudSquirrel we saw was being distributed using ServInt’s Jelastic Platform-As-A-Service(PaaS). These attachments, and links will generally involve a ‘.’ extension, such as “”. “NF-eletronica”, “visualizar boleto” and also the parameter names used in the data exfiltration.ĬloudSquirrel malware typically arrives on the user’s machine as an attachment or a link via email. Primarily affecting Brazilian users based on the facts – file names e.g.Infects users by downloading malicious payloads ( 32 bit and 64 bit executables) that collects information about the victim’s machines including the victim’s email account credentials configured in native email clients.Uses DropBox for its C&C (command and control) server.Uses a variety of cloud services to download its main payload.Listed below are the activities seen in the CloudSquirrel malware campaign: We will talk about technical details in this blog. Last week we posted an article, giving an overview about the CloudSquirrel malware campaign that takes advantage of multiple cloud apps throughout the kill chain with the intent to steal and exfiltrate user data.

Visual depiction of the life cycle of the Cloud Squirrel Attack

Outlookaddressbookview 32bit download