Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_8967a3732f9627c7e3e3d60d8e89c092c59fa1b1bd95a82b863dc23ec6c0a1fc

  • Size

    726.2MB

  • Sample

    241226-x74ayswpbk

  • MD5

    ac1fe82522a2c16f1dfecc207f0122d2

  • SHA1

    ed160f581be4fdaaf26d0df28309e855a7a3b0d7

  • SHA256

    8967a3732f9627c7e3e3d60d8e89c092c59fa1b1bd95a82b863dc23ec6c0a1fc

  • SHA512

    e8957251eab4175115d05839f176f77e789ce9f5011c837ef35e93ab612dce33241a8ce1cc7b9b04dba01773f2089f38ce667343d4c746730e597881bd00a348

  • SSDEEP

    98304:guIaoAV5neTXXKcsXhi49D0GPoOcS6eA7nA7qkn3PV1AcI/Zy20hWDcO6R7J9c:guIaoRTXMh5N0GA+Gq8nZy20Y16L9c

Malware Config

Extracted

Family

raccoon

Botnet

6ba74559cdcbf4f88958c779e52ceea8

C2

http://188.119.112.230/

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Targets

    • Target

      JaffaCakes118_8967a3732f9627c7e3e3d60d8e89c092c59fa1b1bd95a82b863dc23ec6c0a1fc

    • Size

      726.2MB

    • MD5

      ac1fe82522a2c16f1dfecc207f0122d2

    • SHA1

      ed160f581be4fdaaf26d0df28309e855a7a3b0d7

    • SHA256

      8967a3732f9627c7e3e3d60d8e89c092c59fa1b1bd95a82b863dc23ec6c0a1fc

    • SHA512

      e8957251eab4175115d05839f176f77e789ce9f5011c837ef35e93ab612dce33241a8ce1cc7b9b04dba01773f2089f38ce667343d4c746730e597881bd00a348

    • SSDEEP

      98304:guIaoAV5neTXXKcsXhi49D0GPoOcS6eA7nA7qkn3PV1AcI/Zy20hWDcO6R7J9c:guIaoRTXMh5N0GA+Gq8nZy20Y16L9c

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks