General

  • Target

    JaffaCakes118_7e23ea6ba32eee9abf55cf823c6d4ab77e3aaf13f1b1420dc745e53a8636297d

  • Size

    830.2MB

  • Sample

    241230-163vks1nem

  • MD5

    ab4167cde58ab70bda374b9cea749832

  • SHA1

    371d7be152d08f2e1a087e4604ff8ae492198bc0

  • SHA256

    7e23ea6ba32eee9abf55cf823c6d4ab77e3aaf13f1b1420dc745e53a8636297d

  • SHA512

    286bbf8069eff18aee47d5cd5ae4ed14505c3061427dd1a8eea78a9bd34a9f9485b803e69c9f969dfbe74fbbd059cd3ba69aff7bc297ae538afa77e35d55cb5c

  • SSDEEP

    98304:uoDANorfoX181J2cH3P5ihlmvO++hfnDU0GLTFj7/M8cIs39L4xlKvU7UTffDzY:hANGoF8Pj5ihlmvODDU0GLVMj0lG/7D0

Malware Config

Extracted

Family

raccoon

Botnet

334fd5a216b2c3b3e5a3fb91bcdf6c9c

C2

http://77.91.103.191

http://5.182.36.75

Attributes
  • user_agent

    20112211

xor.plain

Targets

    • Target

      JaffaCakes118_7e23ea6ba32eee9abf55cf823c6d4ab77e3aaf13f1b1420dc745e53a8636297d

    • Size

      830.2MB

    • MD5

      ab4167cde58ab70bda374b9cea749832

    • SHA1

      371d7be152d08f2e1a087e4604ff8ae492198bc0

    • SHA256

      7e23ea6ba32eee9abf55cf823c6d4ab77e3aaf13f1b1420dc745e53a8636297d

    • SHA512

      286bbf8069eff18aee47d5cd5ae4ed14505c3061427dd1a8eea78a9bd34a9f9485b803e69c9f969dfbe74fbbd059cd3ba69aff7bc297ae538afa77e35d55cb5c

    • SSDEEP

      98304:uoDANorfoX181J2cH3P5ihlmvO++hfnDU0GLTFj7/M8cIs39L4xlKvU7UTffDzY:hANGoF8Pj5ihlmvODDU0GLVMj0lG/7D0

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks