General

  • Target

    JaffaCakes118_c590aa902b0bd7104fa9141a186a9b54a3d2c1343a4f154b011e9a3cd7b7e942

  • Size

    726.5MB

  • Sample

    241229-25j7hszmav

  • MD5

    a597b84b83f16fbc9c9a36603f3939be

  • SHA1

    72ea27b6e9e2c59b604f3d3c8eaff1e556c96a0a

  • SHA256

    c590aa902b0bd7104fa9141a186a9b54a3d2c1343a4f154b011e9a3cd7b7e942

  • SHA512

    952e3cb0b9da0e9d18b01d1fafa71c46d143b3cdbe6f3f9e49ab888fd68affcafa431bd9e71aef3de9a4c4b2d78b9a565687d13b552b0bc73c548eefa974e3dc

  • SSDEEP

    98304:35xofbcy/4suvHO6qWSdQAVrVPo1sWtddOkHEirZ6fqdgIW0/wS6ap:35ejcTvHODr7hP2FjPkecI8yp

Malware Config

Extracted

Family

raccoon

Botnet

886058af451985da234e1a970b7e57a3

C2

http://45.153.242.180/

Attributes
  • user_agent

    TakeMyPainBack

xor.plain

Targets

    • Target

      JaffaCakes118_c590aa902b0bd7104fa9141a186a9b54a3d2c1343a4f154b011e9a3cd7b7e942

    • Size

      726.5MB

    • MD5

      a597b84b83f16fbc9c9a36603f3939be

    • SHA1

      72ea27b6e9e2c59b604f3d3c8eaff1e556c96a0a

    • SHA256

      c590aa902b0bd7104fa9141a186a9b54a3d2c1343a4f154b011e9a3cd7b7e942

    • SHA512

      952e3cb0b9da0e9d18b01d1fafa71c46d143b3cdbe6f3f9e49ab888fd68affcafa431bd9e71aef3de9a4c4b2d78b9a565687d13b552b0bc73c548eefa974e3dc

    • SSDEEP

      98304:35xofbcy/4suvHO6qWSdQAVrVPo1sWtddOkHEirZ6fqdgIW0/wS6ap:35ejcTvHODr7hP2FjPkecI8yp

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks