General

  • Target

    JaffaCakes118_cc289a97f7e991ebe10a5ca358a4c6c7fe012812ae05b7bc36c97d462dc4e94c

  • Size

    725.9MB

  • Sample

    241224-p5dnhsxrhk

  • MD5

    eece8e698de79298592262c9adfacb82

  • SHA1

    238cffd10523df3ecca73c74e63848cc85cc3fed

  • SHA256

    cc289a97f7e991ebe10a5ca358a4c6c7fe012812ae05b7bc36c97d462dc4e94c

  • SHA512

    87c1aecce22b26c0972555c7b09ba687c6cb7d2e61fa298627ea38b9974b0c2d4d0e1a3326973b3718822fc20194f4ada71554f048ec5ddf9e1dcea33ac6943c

  • SSDEEP

    98304:CTCpxRMeauPe3jnnOyVin/WYMlFS6ysxUvRF2PDKyK//mR55BbLybHc7b2W+:oCpxS5nODYlF9ysx6RFikOBKbHcfw

Malware Config

Extracted

Family

raccoon

Botnet

ddd914293f11706ac5f7e92511dab615

C2

http://94.131.107.76/

http://94.131.107.11/

Attributes
  • user_agent

    x

xor.plain

Targets

    • Target

      JaffaCakes118_cc289a97f7e991ebe10a5ca358a4c6c7fe012812ae05b7bc36c97d462dc4e94c

    • Size

      725.9MB

    • MD5

      eece8e698de79298592262c9adfacb82

    • SHA1

      238cffd10523df3ecca73c74e63848cc85cc3fed

    • SHA256

      cc289a97f7e991ebe10a5ca358a4c6c7fe012812ae05b7bc36c97d462dc4e94c

    • SHA512

      87c1aecce22b26c0972555c7b09ba687c6cb7d2e61fa298627ea38b9974b0c2d4d0e1a3326973b3718822fc20194f4ada71554f048ec5ddf9e1dcea33ac6943c

    • SSDEEP

      98304:CTCpxRMeauPe3jnnOyVin/WYMlFS6ysxUvRF2PDKyK//mR55BbLybHc7b2W+:oCpxS5nODYlF9ysx6RFikOBKbHcfw

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks