PowerPoint-Präsentation

This report documents a multi-stage malware campaign (SquirrelWaffle) starting with a spam email containing a malicious Word document, which drops a VBA/VBS loader chain to download and execute staged PE-DLLs and a Cobalt Strike beacon loader. It details the decryption routines, memory artifacts, and extensive IOCs (URLs, hashes, and sample filenames) across stages 1–5, including embedded CnC servers and related infrastructure.