General

  • Target

    JaffaCakes118_321fd9ced675c13bb60c96069adca71873f9c832d4fd41bc642e7b82203195f5

  • Size

    2.5MB

  • Sample

    241222-ev7thatkgk

  • MD5

    09d0f6c5c289de37a78115e8aa1eaf00

  • SHA1

    0ddafb4307befa92ea5291d367836e34a2d8227c

  • SHA256

    321fd9ced675c13bb60c96069adca71873f9c832d4fd41bc642e7b82203195f5

  • SHA512

    ea0bc62dfb1e2a3de4192895ffff2b91889dd66d121fc4c9bce6dfd57a31594bf12e3cee48c487e564f8a995d4f7fb92ac415770a3b3bc78932681abfdc7c59b

  • SSDEEP

    24576:2gpUFWw9pJ1ZgObY9YcbShI/ME0gQ4PkN5edLKtRLEClF97doyBKHlLt0l3RuQ5v:xrQHZgfEndoyBKHl6l3B

Malware Config

Extracted

Family

raccoon

Botnet

bd3a3a503834ef8e836d8a99d1ecff54

C2

http://77.73.133.7/

Attributes
  • user_agent

    TakeMyPainBack

xor.plain

Targets

    • Target

      JaffaCakes118_321fd9ced675c13bb60c96069adca71873f9c832d4fd41bc642e7b82203195f5

    • Size

      2.5MB

    • MD5

      09d0f6c5c289de37a78115e8aa1eaf00

    • SHA1

      0ddafb4307befa92ea5291d367836e34a2d8227c

    • SHA256

      321fd9ced675c13bb60c96069adca71873f9c832d4fd41bc642e7b82203195f5

    • SHA512

      ea0bc62dfb1e2a3de4192895ffff2b91889dd66d121fc4c9bce6dfd57a31594bf12e3cee48c487e564f8a995d4f7fb92ac415770a3b3bc78932681abfdc7c59b

    • SSDEEP

      24576:2gpUFWw9pJ1ZgObY9YcbShI/ME0gQ4PkN5edLKtRLEClF97doyBKHlLt0l3RuQ5v:xrQHZgfEndoyBKHl6l3B

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks