General

  • Target

    efe92ca1be0addb4fc98740c3433e6b8_JaffaCakes118

  • Size

    615KB

  • Sample

    240921-qxr2lsvfkj

  • MD5

    efe92ca1be0addb4fc98740c3433e6b8

  • SHA1

    571ce44d048685634d3c80254fbd05f6951bf35b

  • SHA256

    fe7c9093446f4bdd5cf993e91b0a6c42780cfac8d4d71dfdbb3c565e633f767f

  • SHA512

    b6fbf86607ba6aa648b29c74bb3fef34c32894c1aa7bdf79aad0849572f74199528b2c58e3a550897b0805745cb38bf3b4da59dc0d2adb216bc6e29918cf5449

  • SSDEEP

    12288:MIWNUtkWj/SVSuArvtADZv3ElWnVuL9h1pBQG2Rb6Ftr9roPr:oUt1j/n91A1vLnVuLDBIpyV9ro

Malware Config

Extracted

Family

raccoon

Botnet

843df8e07013ab494bdde13887b781a28c18cfec

Attributes
  • url4cnc

    https://drive.google.com/uc?export=download&id=1-0SEcuREucC1-k5HBGE8sGu9Fz1AExrZ

rc4.plain
rc4.plain

Targets

    • Target

      efe92ca1be0addb4fc98740c3433e6b8_JaffaCakes118

    • Size

      615KB

    • MD5

      efe92ca1be0addb4fc98740c3433e6b8

    • SHA1

      571ce44d048685634d3c80254fbd05f6951bf35b

    • SHA256

      fe7c9093446f4bdd5cf993e91b0a6c42780cfac8d4d71dfdbb3c565e633f767f

    • SHA512

      b6fbf86607ba6aa648b29c74bb3fef34c32894c1aa7bdf79aad0849572f74199528b2c58e3a550897b0805745cb38bf3b4da59dc0d2adb216bc6e29918cf5449

    • SSDEEP

      12288:MIWNUtkWj/SVSuArvtADZv3ElWnVuL9h1pBQG2Rb6Ftr9roPr:oUt1j/n91A1vLnVuLDBIpyV9ro

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V1 payload

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks