General

  • Target

    cc21871feac73af45f4ea0164b06b212_JaffaCakes118

  • Size

    624KB

  • Sample

    241206-kxbfzazkdv

  • MD5

    cc21871feac73af45f4ea0164b06b212

  • SHA1

    b099c026f0ab5532e816a6c80334726b3e0144a6

  • SHA256

    1f4b4918ff51fa0b9958ae251f3cef25c4e0d2f6465a20d49b7fdd1ae2b7b959

  • SHA512

    fa7a4cb1a81be0130f94a905ffaf1d56519f3ad3999e396d58e2c727253064876343fe7b7a3d7a315df098bfc44fda2dead3d27f7c7a703db417eab8426e4461

  • SSDEEP

    12288:TdNEktR3/ceY8l/kZePnk9rS4e8nZzgRHVdz6DY7NqmE19NTAG5:HEkD/1/pkNe8a/0Y5ZcLAG5

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

510f3093b98732bac65cbd4f7437417970b5b119

Attributes
  • url4cnc

    https://telete.in/h_johng_1

rc4.plain
rc4.plain

Targets

    • Target

      cc21871feac73af45f4ea0164b06b212_JaffaCakes118

    • Size

      624KB

    • MD5

      cc21871feac73af45f4ea0164b06b212

    • SHA1

      b099c026f0ab5532e816a6c80334726b3e0144a6

    • SHA256

      1f4b4918ff51fa0b9958ae251f3cef25c4e0d2f6465a20d49b7fdd1ae2b7b959

    • SHA512

      fa7a4cb1a81be0130f94a905ffaf1d56519f3ad3999e396d58e2c727253064876343fe7b7a3d7a315df098bfc44fda2dead3d27f7c7a703db417eab8426e4461

    • SSDEEP

      12288:TdNEktR3/ceY8l/kZePnk9rS4e8nZzgRHVdz6DY7NqmE19NTAG5:HEkD/1/pkNe8a/0Y5ZcLAG5

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V1 payload

    • Raccoon family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks