General

  • Target

    JaffaCakes118_47915fb7f9b82b1f0f8e46b4e393378c097c3512e7174b4a7837e4dbe1e40263

  • Size

    732.2MB

  • Sample

    241226-ynhqksxmhp

  • MD5

    55d0a7f3164b159dac241420b280db39

  • SHA1

    f151e7ca817b7c55bdef8ceee1320ebf401747a5

  • SHA256

    47915fb7f9b82b1f0f8e46b4e393378c097c3512e7174b4a7837e4dbe1e40263

  • SHA512

    df013f76073fff6bf93fe26d41a5b68d6ca25eb9f389ee54ec871a1caa0f52355e644dc8bab9c1c1a12ef8c9661fcb0d861a7fae394e91b1d1765edf8643cb3f

  • SSDEEP

    393216:whFJpaH0xdG/vOA86H1UY0eejqm54IlSpKAZ:wt5qOAFH8emfWIDAZ

Malware Config

Extracted

Family

raccoon

Botnet

956d6fc3a814efc12713d3f924f5f66a

C2

http://94.142.138.140/

Attributes
  • user_agent

    901785252112

xor.plain

Targets

    • Target

      JaffaCakes118_47915fb7f9b82b1f0f8e46b4e393378c097c3512e7174b4a7837e4dbe1e40263

    • Size

      732.2MB

    • MD5

      55d0a7f3164b159dac241420b280db39

    • SHA1

      f151e7ca817b7c55bdef8ceee1320ebf401747a5

    • SHA256

      47915fb7f9b82b1f0f8e46b4e393378c097c3512e7174b4a7837e4dbe1e40263

    • SHA512

      df013f76073fff6bf93fe26d41a5b68d6ca25eb9f389ee54ec871a1caa0f52355e644dc8bab9c1c1a12ef8c9661fcb0d861a7fae394e91b1d1765edf8643cb3f

    • SSDEEP

      393216:whFJpaH0xdG/vOA86H1UY0eejqm54IlSpKAZ:wt5qOAFH8emfWIDAZ

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks