Overview

overview

10

Static

static

3

JaffaCakes...10.exe

windows7-x64

10

JaffaCakes...10.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-01-2025 11:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_a0e1be86600231cf207722c3e3d0da10.exe

  • Size

    1.1MB

  • MD5

    a0e1be86600231cf207722c3e3d0da10

  • SHA1

    ab857ce14c931bdf98872c44db1921309aae75a1

  • SHA256

    23637601fc7a6c78cc2c3dc9b24de5f6a6361fc048c35a6a6546b52df2183899

  • SHA512

    67da9b31a1e9266b01d9f99b4357bbf749688e398d9b3d9ca867b6f5104f383f476c32d50ceb5e3871362b4ea83176d9249e5d682990542c9b1deeb359d9f594

  • SSDEEP

    24576:hCV8iNS+v6VqfLsyz5Vmt/LYP8igcOlXu6tk+7/xa4k5ArTaIwbfx:YjSVELvN8t/LYLOlu6tk+rxBktIyfx

Score
10/10
raccoon931d69fc7b7e749b0fc5ecbe4199ee96cd6c089ddiscoverystealer

Malware Config

Extracted

Family

raccoon

Version

1.8.2

Botnet

931d69fc7b7e749b0fc5ecbe4199ee96cd6c089d

Attributes
  • url4cnc

    http://telemirror.top/langprothem14

    http://tgmirror.top/langprothem14

    http://telegatt.top/langprothem14

    http://telegka.top/langprothem14

    http://telegin.top/langprothem14

    https://t.me/langprothem14

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V1 payload 1 IoCs
  • Raccoon family
    raccoon
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a0e1be86600231cf207722c3e3d0da10.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a0e1be86600231cf207722c3e3d0da10.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4080-0-0x0000000002820000-0x00000000028B1000-memory.dmp

    Filesize

    580KB

    Download

  • memory/4080-6-0x0000000000400000-0x000000000052A000-memory.dmp

    Filesize

    1.2MB

    Download