General

  • Target

    JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c

  • Size

    726.6MB

  • Sample

    241221-1hq6wazqc1

  • MD5

    27909cdf575b73bba157c6437aaf6417

  • SHA1

    b23e406b4fb65fa94a224188cc1e22b8f6866537

  • SHA256

    639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c

  • SHA512

    00408e9a59517e9d9a16d02a863f5863c545cd8c9934b37e01b7abeaef92bc07c5d0a1a5dde014276f4458344370ec06bb53d3ac4b5e1b52dffb9b21af2e12df

  • SSDEEP

    98304:BYOuLHptGRgfl/J6fNx69CvCmdZHcW4wU0HTFPhXvCD564nJu6Gh/ZGX/U:twJtGRs/J6fNx6AJmCHdKnJu6w/b

Malware Config

Extracted

Family

raccoon

Botnet

0dcbeb99ec1adc5c2b2b94dc1e3fd2c4

C2

http://94.131.106.116/

Attributes
  • user_agent

    TakeMyPainBack

xor.plain

Targets

    • Target

      JaffaCakes118_639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c

    • Size

      726.6MB

    • MD5

      27909cdf575b73bba157c6437aaf6417

    • SHA1

      b23e406b4fb65fa94a224188cc1e22b8f6866537

    • SHA256

      639c2cf00a6d32b4e64430f7744eddf02a8bb4c3c7b2e3b931a81a7c14a9493c

    • SHA512

      00408e9a59517e9d9a16d02a863f5863c545cd8c9934b37e01b7abeaef92bc07c5d0a1a5dde014276f4458344370ec06bb53d3ac4b5e1b52dffb9b21af2e12df

    • SSDEEP

      98304:BYOuLHptGRgfl/J6fNx69CvCmdZHcW4wU0HTFPhXvCD564nJu6Gh/ZGX/U:twJtGRs/J6fNx6AJmCHdKnJu6w/b

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks