Extracted

• • Target

    0b3937c39ea113c3352090ac5ce26103_JaffaCakes118

  • Size

    18.8MB

  • MD5

    0b3937c39ea113c3352090ac5ce26103

  • SHA1

    9db17df61d6222c8d96a3969887d27c1568e4e7b

  • SHA256

    2eeae1c74dff19b7538522acd75a4c9e0d369cec323d4837bdfbc00b8fc81799

  • SHA512

    0bd27f4d58ccfc4b950d727f402ba260f98bf0e99d0f71bba4baa38131fcb0675d0b3105db3bf6bfb95388f0a717a54494ad9be889772b40e5b38f675564aa30

  • SSDEEP

    393216:6Y+TwhZBn9zau6aa17rtANXDa8H1Ecuv9WA2R+y3prshUy:6Y+UV9zau6lKNTLJ29QRy

  Score

  10^/10

  raccoon0343d4da493d263f78921a8724ca6adf05347cfediscoverydropperevasionexecutionpersistenceprivilege_escalationstealertrojan

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V1 payload

  • UAC bypass

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Download via BitsAdmin

    dropper

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2