General

  • Target

    dd0146c74694b0d0a32bab320a8a9ee5_JaffaCakes118

  • Size

    1.9MB

  • Sample

    240912-zdscpstaqr

  • MD5

    dd0146c74694b0d0a32bab320a8a9ee5

  • SHA1

    e706f8d4f153b5c60e502f947bded7950f19a901

  • SHA256

    429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035

  • SHA512

    72bb8daa6eec9edb871dc515049e82851aec29e8d0828093a214a893e210342d5b66b5bed2ee9c27b5463ad5b29df2639078f42a44357ffd5c62cc10b951b1b1

  • SSDEEP

    24576:55dxN4R2R4fbxqOW8vmTMrpiZGbB0dbR2R4fbxqOW8vmTq6QU:55d0yMUrCmooQbadbyMUrCm2ZU

Malware Config

Extracted

Family

raccoon

Botnet

c763e433ef51ff4b6c545800e4ba3b3b1a2ea077

Attributes
  • url4cnc

    https://telete.in/jbitchsucks

rc4.plain
rc4.plain

Targets

    • Target

      dd0146c74694b0d0a32bab320a8a9ee5_JaffaCakes118

    • Size

      1.9MB

    • MD5

      dd0146c74694b0d0a32bab320a8a9ee5

    • SHA1

      e706f8d4f153b5c60e502f947bded7950f19a901

    • SHA256

      429955ad9594118c2d2120d9ed0a0c2d68ed0b605dd948cc8f29055f45ca4035

    • SHA512

      72bb8daa6eec9edb871dc515049e82851aec29e8d0828093a214a893e210342d5b66b5bed2ee9c27b5463ad5b29df2639078f42a44357ffd5c62cc10b951b1b1

    • SSDEEP

      24576:55dxN4R2R4fbxqOW8vmTMrpiZGbB0dbR2R4fbxqOW8vmTq6QU:55d0yMUrCmooQbadbyMUrCm2ZU

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V1 payload

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks