Overview

overview

10

Static

static

3

6nd0y.exe

windows7-x64

10

6nd0y.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_9b09290d92164738d02c6cdc74a3b201a6722af9bf2436fa69831565fe8ea0a9

  • Size

    400KB

  • Sample

    241225-wetels1kaz

  • MD5

    c7c4b08d658658cd988f29eeff6a3d55

  • SHA1

    edb8ef63a3773f22fcd064238903dcd257743d10

  • SHA256

    9b09290d92164738d02c6cdc74a3b201a6722af9bf2436fa69831565fe8ea0a9

  • SHA512

    708fbe18815dceca39240472c893dc42024d59b9b5b9d5de1e0d2ce9355233d4ac72296a5afb074dfc28a4ff9a5934d36bb0bfbcc599274e32d5fbad3e5e871c

  • SSDEEP

    6144:87jFAS/muQBBccyjvIwO41C23TT+Tfj2WsbLOxZ7Gax+CDrWyximwWjmIl6b:aR/r29CO4Y2/+LjOGxZ7VVWywm9jlAb

Score
10/10
raccoonca6c203ef4ac49812d3e458b919004520e3e684bdiscoverystealer

Malware Config

Extracted

Family

raccoon

Botnet

ca6c203ef4ac49812d3e458b919004520e3e684b

Attributes
  • url4cnc

    http://85.159.212.113/josofast

    http://185.163.204.81/josofast

    http://194.180.191.33/josofast

    http://174.138.11.98/josofast

    http://194.180.191.44/josofast

    http://91.219.236.120/josofast

    https://t.me/josofast

rc4.plain
rc4.plain

Targets

    • Target

      6nd0y.bin

    • Size

      510KB

    • MD5

      dca5704bd1e65939693475fd84c63eca

    • SHA1

      679d419e392280269f88ea967c81848b0004dc06

    • SHA256

      02d72fe8ef6500bc4316ed8304d0f50b61589bbc0bb27d3636b88543821e1dc5

    • SHA512

      b168fc37159f5ae8cb1eba3a365442b3e6fddec241c4f5bf8b8bf7ab9939cc5b013cf72c2f12e336ff1caf01ae0aff7d5a60cedb55ef7a299c3ec51fa71784b8

    • SSDEEP

      12288:4bFaeTaaODKlG1afBdslOQx7ADq14X/btwcNMval:2I2W+p7slJxzipwWMyl

    Score
    10/10
    raccoonca6c203ef4ac49812d3e458b919004520e3e684bdiscoverystealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V1 payload

    • Raccoon family

      raccoon
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks