General

  • Target

    JaffaCakes118_d46fb950324dba8e3ebc02e585f95c955831f64e6862ed7aa784500d57e6b059

  • Size

    726.3MB

  • Sample

    241222-qe1k2ayqhs

  • MD5

    58b2ef3e24ab47c345a3a9d5f32f0b4d

  • SHA1

    cfd076c5116f0e854654fb4ff7f4754a8353d2e6

  • SHA256

    d46fb950324dba8e3ebc02e585f95c955831f64e6862ed7aa784500d57e6b059

  • SHA512

    eda841205af373f0319e9e7e144e50a2001f748be1d170874f0ab21fee5ee7aa3481d97a86bf1128ef225beff60ed54ff29228845716afddc0b9804cfade6d4a

  • SSDEEP

    98304:o1J/dTNzO5BrPzcvdsvV4KehQZUPOPjLuThgvoWU1VPf8r:GlTNy5BrPYvKd4CUPOPGaWPfu

Malware Config

Extracted

Family

raccoon

Botnet

b3e62a345d90ee80b30dcc988ddc399f

C2

http://170.75.168.118/

http://51.195.166.172/

http://85.192.63.125/

Attributes
  • user_agent

    TakeMyPainBack

xor.plain

Targets

    • Target

      JaffaCakes118_d46fb950324dba8e3ebc02e585f95c955831f64e6862ed7aa784500d57e6b059

    • Size

      726.3MB

    • MD5

      58b2ef3e24ab47c345a3a9d5f32f0b4d

    • SHA1

      cfd076c5116f0e854654fb4ff7f4754a8353d2e6

    • SHA256

      d46fb950324dba8e3ebc02e585f95c955831f64e6862ed7aa784500d57e6b059

    • SHA512

      eda841205af373f0319e9e7e144e50a2001f748be1d170874f0ab21fee5ee7aa3481d97a86bf1128ef225beff60ed54ff29228845716afddc0b9804cfade6d4a

    • SSDEEP

      98304:o1J/dTNzO5BrPzcvdsvV4KehQZUPOPjLuThgvoWU1VPf8r:GlTNy5BrPYvKd4CUPOPGaWPfu

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks