General

  • Target

    JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b

  • Size

    733.1MB

  • Sample

    241224-mbbkysvmfm

  • MD5

    bd7147c5a9ac0f9a6b6076466f7d611f

  • SHA1

    1baac5f76a99ab503630aeaafbebbe1addf997e8

  • SHA256

    ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b

  • SHA512

    0249f9a62b14ba5a7b0d3a32e0aa98bf7779fc31e9f968fa81cefaa8db8f1d62e6a87d813260746052d4ef00afd42191d2ddee501e97de793f2c099e0af50c04

  • SSDEEP

    393216:QUWrN0Da9MZln8zmG9jy3Xly3naFgnXtxlWtI:QbrqGSZZ89jGXSaunXIS

Malware Config

Extracted

Family

raccoon

Botnet

fcfc256ec04f34118490eadaac61e88d

C2

http://37.220.87.66/

Attributes
  • user_agent

    B1D3N_RIM_MY_ASS

xor.plain

Targets

    • Target

      JaffaCakes118_ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b

    • Size

      733.1MB

    • MD5

      bd7147c5a9ac0f9a6b6076466f7d611f

    • SHA1

      1baac5f76a99ab503630aeaafbebbe1addf997e8

    • SHA256

      ac43f5d7e381416f8dd4810dd27384d940295068efa853eadbc5e8644470d11b

    • SHA512

      0249f9a62b14ba5a7b0d3a32e0aa98bf7779fc31e9f968fa81cefaa8db8f1d62e6a87d813260746052d4ef00afd42191d2ddee501e97de793f2c099e0af50c04

    • SSDEEP

      393216:QUWrN0Da9MZln8zmG9jy3Xly3naFgnXtxlWtI:QbrqGSZZ89jGXSaunXIS

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks