General

  • Target

    JaffaCakes118_88645bc9da6ddd1789ad2af11e91a808a7e5f5b8c858687106766b3f64441d64

  • Size

    726.7MB

  • Sample

    241224-ncevfawndl

  • MD5

    c5c73e442e6e2581a7b82620ca35000b

  • SHA1

    904f581635c55c5be9735a27b024dac8d1e7dfa4

  • SHA256

    88645bc9da6ddd1789ad2af11e91a808a7e5f5b8c858687106766b3f64441d64

  • SHA512

    15986b4d3f8f7284861445c2c10c7be97aa849404e941b2600c024a2ddb3ce4e4fddd7e0792b7b2635374d971e09c06c1b594204e7362745e50c4ed185ca7a73

  • SSDEEP

    196608:ex1ywBXWOEW7/IuV7YTIE1eAF+8k0Kq14EgQbtGGI:ex1lVEWrp8T9j88kNq14EndI

Malware Config

Extracted

Family

raccoon

Botnet

4e27b39e9aaa6403f36702b4d66f5024

C2

http://94.142.138.10/

http://94.142.138.9/

Attributes
  • user_agent

    23591

xor.plain

Targets

    • Target

      JaffaCakes118_88645bc9da6ddd1789ad2af11e91a808a7e5f5b8c858687106766b3f64441d64

    • Size

      726.7MB

    • MD5

      c5c73e442e6e2581a7b82620ca35000b

    • SHA1

      904f581635c55c5be9735a27b024dac8d1e7dfa4

    • SHA256

      88645bc9da6ddd1789ad2af11e91a808a7e5f5b8c858687106766b3f64441d64

    • SHA512

      15986b4d3f8f7284861445c2c10c7be97aa849404e941b2600c024a2ddb3ce4e4fddd7e0792b7b2635374d971e09c06c1b594204e7362745e50c4ed185ca7a73

    • SSDEEP

      196608:ex1ywBXWOEW7/IuV7YTIE1eAF+8k0Kq14EgQbtGGI:ex1lVEWrp8T9j88kNq14EndI

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks