General

  • Target

    JaffaCakes118_45c3bdfda5f7cdc0794c28f2554d0e741884588118a0717f9efe2709c227792d

  • Size

    726.3MB

  • Sample

    241223-r82wmaspek

  • MD5

    9e66aa4f703b9749eb9cf2144137b7a3

  • SHA1

    d0f16ad4314c357f117203e4531a953824e8f96e

  • SHA256

    45c3bdfda5f7cdc0794c28f2554d0e741884588118a0717f9efe2709c227792d

  • SHA512

    5b23f87078542a7e9b157497b2e7408e20151a42d6a7d342d22d175ad7a16a27fd8d4d44d823d69657d473f08099fb36e4f14037ae314e2beee4c6941c1a9b65

  • SSDEEP

    196608:z9nc3KD957STAWlTgYq4NEesOmM16r6lByuw:z9c3KXePtgYq42esO96kyuw

Malware Config

Extracted

Family

raccoon

Botnet

98c51879fa11653e0dd6ddfa38754998

C2

http://89.185.85.175/

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Targets

    • Target

      JaffaCakes118_45c3bdfda5f7cdc0794c28f2554d0e741884588118a0717f9efe2709c227792d

    • Size

      726.3MB

    • MD5

      9e66aa4f703b9749eb9cf2144137b7a3

    • SHA1

      d0f16ad4314c357f117203e4531a953824e8f96e

    • SHA256

      45c3bdfda5f7cdc0794c28f2554d0e741884588118a0717f9efe2709c227792d

    • SHA512

      5b23f87078542a7e9b157497b2e7408e20151a42d6a7d342d22d175ad7a16a27fd8d4d44d823d69657d473f08099fb36e4f14037ae314e2beee4c6941c1a9b65

    • SSDEEP

      196608:z9nc3KD957STAWlTgYq4NEesOmM16r6lByuw:z9c3KXePtgYq42esO96kyuw

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks