General

  • Target

    JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918

  • Size

    815.4MB

  • Sample

    241224-l1fersvjbv

  • MD5

    8d09a44d7b7ecdc7acb2aad0376a38c6

  • SHA1

    91ba128382958716bae664ff0af101da6d44be3c

  • SHA256

    85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918

  • SHA512

    4afa4befb406bf174384869b9514a5e74a4ce6b1d3f5978d9fec42ca2d04487f17661fd817caa14725f309844d3b0879861eb503521a30ec72ca25ff64218b2a

  • SSDEEP

    98304:cTxPupJkmHmooywZfLGc6D6yT+nHZH6JnIRLfZNlT3/Msj:cTAkaoBxLc6lnHZH6Y/Msj

Malware Config

Extracted

Family

raccoon

Botnet

1c145396a071df7e490bd2cf3def4bdf

C2

http://45.15.156.215/

Attributes
  • user_agent

    901785252112

xor.plain

Targets

    • Target

      JaffaCakes118_85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918

    • Size

      815.4MB

    • MD5

      8d09a44d7b7ecdc7acb2aad0376a38c6

    • SHA1

      91ba128382958716bae664ff0af101da6d44be3c

    • SHA256

      85bfbde0fd013241fd5ed1f099874814c813d4ac968d6ce8e0be93e8b07e3918

    • SHA512

      4afa4befb406bf174384869b9514a5e74a4ce6b1d3f5978d9fec42ca2d04487f17661fd817caa14725f309844d3b0879861eb503521a30ec72ca25ff64218b2a

    • SSDEEP

      98304:cTxPupJkmHmooywZfLGc6D6yT+nHZH6JnIRLfZNlT3/Msj:cTAkaoBxLc6lnHZH6Y/Msj

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks