General

  • Target

    JaffaCakes118_09f4877e088cba4e18f533752ce5a046941b55405ddc5c5e891016da16c47d6f

  • Size

    726.2MB

  • Sample

    241228-2tahyavjhm

  • MD5

    84ea856e941ad127d8e59a405c3480c8

  • SHA1

    8f463d0a4301333dfaf51b5bf0248bbc37edfde0

  • SHA256

    09f4877e088cba4e18f533752ce5a046941b55405ddc5c5e891016da16c47d6f

  • SHA512

    8fc0198d40ebad9d3b1074c77695574a87a93e9bd491c2ab6ec0754e8495bd97031cd77135a2777c7c97fa24c4e96ebd1d1f6a728151dede95b20cf7057df80a

  • SSDEEP

    98304:TtBwlxns9cahNP5hngbkANlGWrHW9boRPL9XkHck0ypB27bvrQrVsIPs2VBn7oeu:Tz9cavRhYNlfJlYpB27UVT00l7EegT

Malware Config

Extracted

Family

raccoon

Botnet

3cc7f744b4c36555641d7176a4d5b862

C2

http://78.159.103.196

http://78.159.103.214/

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Targets

    • Target

      JaffaCakes118_09f4877e088cba4e18f533752ce5a046941b55405ddc5c5e891016da16c47d6f

    • Size

      726.2MB

    • MD5

      84ea856e941ad127d8e59a405c3480c8

    • SHA1

      8f463d0a4301333dfaf51b5bf0248bbc37edfde0

    • SHA256

      09f4877e088cba4e18f533752ce5a046941b55405ddc5c5e891016da16c47d6f

    • SHA512

      8fc0198d40ebad9d3b1074c77695574a87a93e9bd491c2ab6ec0754e8495bd97031cd77135a2777c7c97fa24c4e96ebd1d1f6a728151dede95b20cf7057df80a

    • SSDEEP

      98304:TtBwlxns9cahNP5hngbkANlGWrHW9boRPL9XkHck0ypB27bvrQrVsIPs2VBn7oeu:Tz9cavRhYNlfJlYpB27UVT00l7EegT

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks