General

  • Target

    JaffaCakes118_12dd22f3a312b2558caa2ccea1796a4b7ca7d5635c703175e0289e6590b48220

  • Size

    771.6MB

  • Sample

    241225-c5837svnbt

  • MD5

    ce498d59fae27f5c42cda32c26d43520

  • SHA1

    0eef9a1941d93e04cd6797ed6c79c6ca202f40dc

  • SHA256

    12dd22f3a312b2558caa2ccea1796a4b7ca7d5635c703175e0289e6590b48220

  • SHA512

    8c64f222d5322f3324b6658c9bee77c6233cce4c9120a4c1e30181e9c33fe0f6aec67d67d1c27dff6657a2bb6195d0a80bf6ca4cdc5cf054dca1be3ac65f6daa

  • SSDEEP

    25165824:znnnnnnnnnnnnnnnnnnnnn3nnnnnnnnnnnnnnnnnnnnn3nnnF:znnnnnnnnnnnnnnnnnnnnn3nnnnnnnn1

Malware Config

Extracted

Family

raccoon

Botnet

d843e8fa1ee1dfc195b20362a6b5cd71

C2

http://91.103.252.156:80/

Attributes
  • user_agent

    DuckTales

xor.plain

Targets

    • Target

      JaffaCakes118_12dd22f3a312b2558caa2ccea1796a4b7ca7d5635c703175e0289e6590b48220

    • Size

      771.6MB

    • MD5

      ce498d59fae27f5c42cda32c26d43520

    • SHA1

      0eef9a1941d93e04cd6797ed6c79c6ca202f40dc

    • SHA256

      12dd22f3a312b2558caa2ccea1796a4b7ca7d5635c703175e0289e6590b48220

    • SHA512

      8c64f222d5322f3324b6658c9bee77c6233cce4c9120a4c1e30181e9c33fe0f6aec67d67d1c27dff6657a2bb6195d0a80bf6ca4cdc5cf054dca1be3ac65f6daa

    • SSDEEP

      25165824:znnnnnnnnnnnnnnnnnnnnn3nnnnnnnnnnnnnnnnnnnnn3nnnF:znnnnnnnnnnnnnnnnnnnnn3nnnnnnnn1

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

MITRE ATT&CK Enterprise v15

Tasks