General

  • Target

    JaffaCakes118_04c353124651ebf3418908cf791b373504c41b2c752dcfd108c093fbae7a395d

  • Size

    733.1MB

  • Sample

    241222-l5r95atrdm

  • MD5

    225641816c545b5601bde4dac1a5f866

  • SHA1

    2b23b4ec86446d62b9eff9f59ab5d24a3c9894cc

  • SHA256

    04c353124651ebf3418908cf791b373504c41b2c752dcfd108c093fbae7a395d

  • SHA512

    4c3a3833efdf6291545754d53190beffe936169baee7506c534f1179f9b0b7b4d2904abce8880f4b5b2495c3907bb5766ce3050de0074189e6a0e41893978e5f

  • SSDEEP

    196608:FFChjA8PGbyXxYvJoQ4cJeBdg1dS6OHMiKIYeI4UzeqCI39GI7xkopTjR5ailjIX:nChjA8PGb4YvJd5ryh/LERdkOvailji3

Malware Config

Extracted

Family

raccoon

Botnet

fcfc256ec04f34118490eadaac61e88d

C2

http://45.9.74.170

http://77.73.134.43

Attributes
  • user_agent

    B1D3N_RIM_MY_ASS

xor.plain

Targets

    • Target

      JaffaCakes118_04c353124651ebf3418908cf791b373504c41b2c752dcfd108c093fbae7a395d

    • Size

      733.1MB

    • MD5

      225641816c545b5601bde4dac1a5f866

    • SHA1

      2b23b4ec86446d62b9eff9f59ab5d24a3c9894cc

    • SHA256

      04c353124651ebf3418908cf791b373504c41b2c752dcfd108c093fbae7a395d

    • SHA512

      4c3a3833efdf6291545754d53190beffe936169baee7506c534f1179f9b0b7b4d2904abce8880f4b5b2495c3907bb5766ce3050de0074189e6a0e41893978e5f

    • SSDEEP

      196608:FFChjA8PGbyXxYvJoQ4cJeBdg1dS6OHMiKIYeI4UzeqCI39GI7xkopTjR5ailjIX:nChjA8PGb4YvJd5ryh/LERdkOvailji3

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks