General

  • Target

    ec3066ac3d7faede11c3bb7df3f6b872_JaffaCakes118

  • Size

    4.5MB

  • Sample

    240410-25x4dadh28

  • MD5

    ec3066ac3d7faede11c3bb7df3f6b872

  • SHA1

    994f3c6ba7101e5b80f38e0968696af01da6dbbf

  • SHA256

    c6b917da656cf9c14799d19cc919feb2315b334fe7f0534cd98edee4cd05cec0

  • SHA512

    d005c1d5f410cd7ad3bf94b0ee3ba61c9f8d5b85fe0eed225d7cda9c3f88e6a848a69d00a83e330144e0df45fd9cbbbd8e717411d4126ad4292f8a7e437caf17

  • SSDEEP

    12288:ArHKyMwls7rZS/7EFuMRyKaqbH7QN9m82Eeyd8LCx+ZrHfYidPg904AX0dJKwkPi:Vyz

Malware Config

Extracted

Family

raccoon

Botnet

ae3f35ee374443213a24cbebe42eb00da2927d54

Attributes
  • url4cnc

    https://t.me/gishsunsetman

rc4.plain
rc4.plain

Targets

    • Target

      ec3066ac3d7faede11c3bb7df3f6b872_JaffaCakes118

    • Size

      4.5MB

    • MD5

      ec3066ac3d7faede11c3bb7df3f6b872

    • SHA1

      994f3c6ba7101e5b80f38e0968696af01da6dbbf

    • SHA256

      c6b917da656cf9c14799d19cc919feb2315b334fe7f0534cd98edee4cd05cec0

    • SHA512

      d005c1d5f410cd7ad3bf94b0ee3ba61c9f8d5b85fe0eed225d7cda9c3f88e6a848a69d00a83e330144e0df45fd9cbbbd8e717411d4126ad4292f8a7e437caf17

    • SSDEEP

      12288:ArHKyMwls7rZS/7EFuMRyKaqbH7QN9m82Eeyd8LCx+ZrHfYidPg904AX0dJKwkPi:Vyz

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V1 payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks