General

  • Target

    JaffaCakes118_3d7b02e62a72a648503dbee21204b72b22ec6ef39f574c81dc5a072c4f8283a8

  • Size

    650.2MB

  • Sample

    241230-elm3qsxncz

  • MD5

    baeb3316e444a69b02f39ef5a87b54a0

  • SHA1

    beff9fbc07e2c90d3aef8ca7e89f738980c88e4a

  • SHA256

    3d7b02e62a72a648503dbee21204b72b22ec6ef39f574c81dc5a072c4f8283a8

  • SHA512

    03d97e677bd37935b24c6d495ebe9008f4cbbc447bcf2de50d164ae06d40bfd33e26d68fb5f5336a1f87507794b3fc0bd913531148fdd664e9fdd3702151e80c

  • SSDEEP

    3072:80rSPM1VrG9kEV8Ow7uhWuYRjd5fHlWbrJtVA:8L4TpuhWuY9dFMbrTVA

Malware Config

Extracted

Family

raccoon

Botnet

2bdc8b70f9d4d48bc949e7397bff9ceb

C2

http://168.100.11.23/

Attributes
  • user_agent

    mozzzzzzzzzzz

xor.plain

Targets

    • Target

      JaffaCakes118_3d7b02e62a72a648503dbee21204b72b22ec6ef39f574c81dc5a072c4f8283a8

    • Size

      650.2MB

    • MD5

      baeb3316e444a69b02f39ef5a87b54a0

    • SHA1

      beff9fbc07e2c90d3aef8ca7e89f738980c88e4a

    • SHA256

      3d7b02e62a72a648503dbee21204b72b22ec6ef39f574c81dc5a072c4f8283a8

    • SHA512

      03d97e677bd37935b24c6d495ebe9008f4cbbc447bcf2de50d164ae06d40bfd33e26d68fb5f5336a1f87507794b3fc0bd913531148fdd664e9fdd3702151e80c

    • SSDEEP

      3072:80rSPM1VrG9kEV8Ow7uhWuYRjd5fHlWbrJtVA:8L4TpuhWuY9dFMbrTVA

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks