General

  • Target

    df81d775612d1565e5564d416420c2fd_JaffaCakes118

  • Size

    1004KB

  • Sample

    240914-fat8caxbnn

  • MD5

    df81d775612d1565e5564d416420c2fd

  • SHA1

    49252eae3983eaa89eea12b5f5b65c5e147d3e5b

  • SHA256

    d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e

  • SHA512

    a20e59cff9cd30efa06a5bb5c935d119e19d74f289d22335173e64046c634c4ed2b87db5b0e774c90d87c0b34686b4a7e4a9ff8e3e9c8d56207ccc6146ff03d9

  • SSDEEP

    24576:iGVJLVwfsOmo3MYYFhSHOEIk3XWT9JZH9h:X433nYpEIkonZH9h

Malware Config

Extracted

Family

raccoon

Version

1.7.2

Botnet

8e94b823a9991735de58978b0e8609a618f8ddd3

Attributes
  • url4cnc

    https://tttttt.me/brikitiki

rc4.plain
rc4.plain

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Extracted

Family

oski

C2

hanxlas.ac.ug

Targets

    • Target

      df81d775612d1565e5564d416420c2fd_JaffaCakes118

    • Size

      1004KB

    • MD5

      df81d775612d1565e5564d416420c2fd

    • SHA1

      49252eae3983eaa89eea12b5f5b65c5e147d3e5b

    • SHA256

      d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e

    • SHA512

      a20e59cff9cd30efa06a5bb5c935d119e19d74f289d22335173e64046c634c4ed2b87db5b0e774c90d87c0b34686b4a7e4a9ff8e3e9c8d56207ccc6146ff03d9

    • SSDEEP

      24576:iGVJLVwfsOmo3MYYFhSHOEIk3XWT9JZH9h:X433nYpEIkonZH9h

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Oski

      Oski is an infostealer targeting browser data, crypto wallets.

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V1 payload

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks