General

  • Target

    JaffaCakes118_832c396a02fc2880c3883489463bf74ee9b42d2b43ebd94abe44223df366c12e

  • Size

    726.7MB

  • Sample

    241225-hg9ygszpgx

  • MD5

    3cf0639e84cf78d2ac0ce731c3d4d123

  • SHA1

    27e212380fe0d4dc18990788d972d3720af05dc3

  • SHA256

    832c396a02fc2880c3883489463bf74ee9b42d2b43ebd94abe44223df366c12e

  • SHA512

    34cc856cb91102f29263c870489e4850f4dad914f3b528526cb9414f9c4fc43e052493300a0d8604685a1fb4a2215aa644d4acbfeb25b09a36d139d5fb232e66

  • SSDEEP

    196608:lLt/NG3aEonEquSgRFtFSFgXpbMrf6npDxV3wHDUJqyr9ck:X83sEdSeXpIrf6njVJok

Malware Config

Extracted

Family

raccoon

Botnet

57ae09fc420e77e21d5d0f9e3df449d8

C2

http://79.137.199.211/

http://79.137.199.215/

Attributes
  • user_agent

    23591

xor.plain

Targets

    • Target

      JaffaCakes118_832c396a02fc2880c3883489463bf74ee9b42d2b43ebd94abe44223df366c12e

    • Size

      726.7MB

    • MD5

      3cf0639e84cf78d2ac0ce731c3d4d123

    • SHA1

      27e212380fe0d4dc18990788d972d3720af05dc3

    • SHA256

      832c396a02fc2880c3883489463bf74ee9b42d2b43ebd94abe44223df366c12e

    • SHA512

      34cc856cb91102f29263c870489e4850f4dad914f3b528526cb9414f9c4fc43e052493300a0d8604685a1fb4a2215aa644d4acbfeb25b09a36d139d5fb232e66

    • SSDEEP

      196608:lLt/NG3aEonEquSgRFtFSFgXpbMrf6npDxV3wHDUJqyr9ck:X83sEdSeXpIrf6njVJok

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks