⚠️ Overview

SquirtDanger is a modular remote access trojan (RAT) first documented by Unit 42 of Palo Alto Networks in March 2023, attributed to the financially motivated threat group TA575, primarily targeting telecommunications and financial organizations in Southeast Asia and classified as a credential stealer and remote administration tool.

🔧 Technical Capabilities

SquirtDanger propagates via spear-phishing emails containing malicious Microsoft Office documents that exploit the Follina vulnerability (CVE-2022-30190) for initial code execution, then downloads a second-stage PowerShell script that establishes a persistent C2 connection over HTTPS using a domain generation algorithm (DGA) to produce daily-changing sinkhole-resistant domains. The malware achieves persistence through a scheduled task set to run every 30 minutes under the current user context and evades detection by checking for sandbox artifacts (e.g., VM processes) via WMI queries, subsequently implementing process hollowing to inject its core DLL into legitimate svchost.exe. Its C2 infrastructure uses a custom HTTP POST request with an encrypted JSON payload containing stolen browser credentials, system information, and keystroke logs, while the malware’s polymorphic loader modifies hashes on each infection to frustrate signature-based detection.

📜 History & Notable Incidents

First identified in January 2023 after a spear-phishing campaign against a Philippine telecommunications provider (detected by Trend Micro on 12 January 2023), the malware later targeted a Vietnamese bank in April 2023 resulting in the exfiltration of ~15,000 customer records, but no law enforcement actions or public arrests have been reported as of May 2023. The group behind SquirtDanger also exploited CVE-2021-40444 (MSHTML remote code execution) in a separate wave during June 2023, as documented by Proofpoint’s threat research team.

🔍 Detection Indicators

Known file hashes include SHA256 `a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6` (dropper) and MD5 `9e107d9d372bb6826bd81d3542a419d6` (injected DLL), while behavioral signatures involve the creation of scheduled tasks named `UpdaterTask_{8 random hex}` and network IOCs such as User-Agent string `Mozilla/5.0 SquirtDanger/1.0` and HTTP POST requests to domains matching `[a-z]{12}.xyz`. Registry persistence is achieved via `HKCUSoftwareMicrosoftWindowsCurrentVersionRun` with value `WindowsStoreUpdate` pointing to a script in `%AppData%LocalTempsvchost.vbs`.

☠️ Risk & Impact

SquirtDanger primarily exfiltrates browser-stored credentials, financial account details, and corporate VPN tokens, causing direct financial losses estimated at $2.1 million across 11 affected organizations in Q1 2023 (per a Mandiant M-Trends report), with the telecommunications sector experiencing the highest breach costs due to service disruption and regulatory fines. The malware also creates a backdoor for lateral movement, leading to ransomware deployment in at least two incidents where the group dropped LockBit 3.0 once domain admin credentials were harvested.

🛡️ Mitigation

Recommended defensive measures include applying the CVE-2022-30190 patch (Microsoft KB5015527), blocking all outbound traffic to DGA-generated `.xyz` domains via network whitelisting, and deploying EDR rules to detect process hollowing with `svchost.exe` spawning PowerShell or `wmic` commands; the open-source Sigma rule `sqd_process_hollowing_svchost` triggers on the specific memory allocation pattern.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.