General

  • Target

    JaffaCakes118_1869048ac0950334fb378da3664e51f571834ced5d5b074829bbcb73915fa272

  • Size

    726.8MB

  • Sample

    241225-s6h66sxmbl

  • MD5

    ed2abd34f3122f02b1468a5154107704

  • SHA1

    e698675dcbf4cb9e5e434e7c1b28ab61c383da66

  • SHA256

    1869048ac0950334fb378da3664e51f571834ced5d5b074829bbcb73915fa272

  • SHA512

    4d5f2370774856c2366a5af48cdf13ab53e947fc6adfe69f70e7deb82e1ae2afe93d2177eec219f57c469957d7c5c323d4b5c955ea0668220a6fbddca33c5116

  • SSDEEP

    98304:RRYfW5HREioMXcZJwk4ZlwDhitFydb4ALQqOMpO6VeYL5ekkm/81QXH1gdpY4RDU:gO5Hii+ZJwkNDVXiM2ElH01KQiFzuM

Malware Config

Extracted

Family

raccoon

Botnet

18f607f2dbc9c07a5f0e032f2f244e12

C2

http://188.119.112.230/

Attributes
  • user_agent

    mozzzzzzzzzzz

rc4.plain

Targets

    • Target

      JaffaCakes118_1869048ac0950334fb378da3664e51f571834ced5d5b074829bbcb73915fa272

    • Size

      726.8MB

    • MD5

      ed2abd34f3122f02b1468a5154107704

    • SHA1

      e698675dcbf4cb9e5e434e7c1b28ab61c383da66

    • SHA256

      1869048ac0950334fb378da3664e51f571834ced5d5b074829bbcb73915fa272

    • SHA512

      4d5f2370774856c2366a5af48cdf13ab53e947fc6adfe69f70e7deb82e1ae2afe93d2177eec219f57c469957d7c5c323d4b5c955ea0668220a6fbddca33c5116

    • SSDEEP

      98304:RRYfW5HREioMXcZJwk4ZlwDhitFydb4ALQqOMpO6VeYL5ekkm/81QXH1gdpY4RDU:gO5Hii+ZJwkNDVXiM2ElH01KQiFzuM

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks