General

  • Target

    JaffaCakes118_a3cb9d4422229cb9c6b03bd661295f2efd238a63b163b517fd2833d4601afe2c

  • Size

    1.7MB

  • Sample

    241230-x95lssxqaz

  • MD5

    75631369c460eb9e6839661a91446d42

  • SHA1

    6b643fc76a941c1698f108b61d2c1c661a845b72

  • SHA256

    a3cb9d4422229cb9c6b03bd661295f2efd238a63b163b517fd2833d4601afe2c

  • SHA512

    98b79f47b96340fa58e1c764a3dead082096872f0a7f02938818401bf8346a163807208e239685a7c91a31319043bcdfa0cc4a421672f2584a013f4039e0b8c8

  • SSDEEP

    24576:XLBjGH36ZAjVBYxoQYAoDnTbMgIHLwKd9fLSkhYWMk0h/no6sg1LvI3en:7pGHKZAjVofMk0h/o6sg1bsg

Malware Config

Extracted

Family

raccoon

Botnet

bd3a3a503834ef8e836d8a99d1ecff54

C2

http://77.73.133.7/

Attributes
  • user_agent

    TakeMyPainBack

xor.plain

Targets

    • Target

      JaffaCakes118_a3cb9d4422229cb9c6b03bd661295f2efd238a63b163b517fd2833d4601afe2c

    • Size

      1.7MB

    • MD5

      75631369c460eb9e6839661a91446d42

    • SHA1

      6b643fc76a941c1698f108b61d2c1c661a845b72

    • SHA256

      a3cb9d4422229cb9c6b03bd661295f2efd238a63b163b517fd2833d4601afe2c

    • SHA512

      98b79f47b96340fa58e1c764a3dead082096872f0a7f02938818401bf8346a163807208e239685a7c91a31319043bcdfa0cc4a421672f2584a013f4039e0b8c8

    • SSDEEP

      24576:XLBjGH36ZAjVBYxoQYAoDnTbMgIHLwKd9fLSkhYWMk0h/no6sg1LvI3en:7pGHKZAjVofMk0h/o6sg1bsg

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon family

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks