General

  • Target

    JaffaCakes118_8d2d9f3e9d745af475e4f43299381c95cd8d8fa6771b8bc229ab3a285028df4c

  • Size

    726.3MB

  • Sample

    241230-18dy8stqgz

  • MD5

    404f92f8c6f0ddd6c75e0e6cda85b8a9

  • SHA1

    05cf0d32101ad6c70ddd142cacfa112a1897a5a5

  • SHA256

    8d2d9f3e9d745af475e4f43299381c95cd8d8fa6771b8bc229ab3a285028df4c

  • SHA512

    3da0419cc728cf5ce99b150c80f0415c52ea2bffee656f1dff82a8e02a30e716c9d67f350916389395aa1bacf1f7aa954b925ea7aeb1174b2702b9c986269b48

  • SSDEEP

    98304:C+5Z98HF7E9ezcDo1GHxfHi4sN4Kufh6e4IRfrS0s4HWINqUlXp+zJQwzP4Lfr+u:xX8l4KOlZuu0e/A0s4HWe5iQU4F1++H

Malware Config

Extracted

Family

raccoon

Botnet

9d1e4355c2f2db3d7a690c4ac83e7372

C2

http://77.73.133.1/

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Targets

    • Target

      JaffaCakes118_8d2d9f3e9d745af475e4f43299381c95cd8d8fa6771b8bc229ab3a285028df4c

    • Size

      726.3MB

    • MD5

      404f92f8c6f0ddd6c75e0e6cda85b8a9

    • SHA1

      05cf0d32101ad6c70ddd142cacfa112a1897a5a5

    • SHA256

      8d2d9f3e9d745af475e4f43299381c95cd8d8fa6771b8bc229ab3a285028df4c

    • SHA512

      3da0419cc728cf5ce99b150c80f0415c52ea2bffee656f1dff82a8e02a30e716c9d67f350916389395aa1bacf1f7aa954b925ea7aeb1174b2702b9c986269b48

    • SSDEEP

      98304:C+5Z98HF7E9ezcDo1GHxfHi4sN4Kufh6e4IRfrS0s4HWINqUlXp+zJQwzP4Lfr+u:xX8l4KOlZuu0e/A0s4HWe5iQU4F1++H

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks