General

  • Target

    JaffaCakes118_8e81cb2b4fa3e524879ddb5a73e571c79107cce37e727abfd16188e87cc357cb

  • Size

    726.7MB

  • Sample

    241225-1rh7mazjgk

  • MD5

    ac29cbf9313e3b6bb489bc9f50eb108e

  • SHA1

    d1ff2c6fe68acfce78ad1bbc2142f6220c93d781

  • SHA256

    8e81cb2b4fa3e524879ddb5a73e571c79107cce37e727abfd16188e87cc357cb

  • SHA512

    d51d351d1ac4a1232718a97faad1205370bd8777f62cc0fab1da468b920bfe868fe7219684453beb884b8151f44b51cfaa80872d19c96f4594350f4b86fc447e

  • SSDEEP

    196608:h1Vqf+JZwA8csCao3+r2gq1j6Ii0hGv6JkU5ZQwjVLQM3x:LB8c3aoaM+Ii2GvsnB

Malware Config

Extracted

Family

raccoon

Botnet

8c3e4aa007fb2f2defacc1f952806f72

C2

http://170.75.173.138/

http://85.192.63.243/

Attributes
  • user_agent

    23591

xor.plain

Targets

    • Target

      JaffaCakes118_8e81cb2b4fa3e524879ddb5a73e571c79107cce37e727abfd16188e87cc357cb

    • Size

      726.7MB

    • MD5

      ac29cbf9313e3b6bb489bc9f50eb108e

    • SHA1

      d1ff2c6fe68acfce78ad1bbc2142f6220c93d781

    • SHA256

      8e81cb2b4fa3e524879ddb5a73e571c79107cce37e727abfd16188e87cc357cb

    • SHA512

      d51d351d1ac4a1232718a97faad1205370bd8777f62cc0fab1da468b920bfe868fe7219684453beb884b8151f44b51cfaa80872d19c96f4594350f4b86fc447e

    • SSDEEP

      196608:h1Vqf+JZwA8csCao3+r2gq1j6Ii0hGv6JkU5ZQwjVLQM3x:LB8c3aoaM+Ii2GvsnB

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks