Overview

overview

10

Static

static

10

1cbb1d0d8f...18.exe

windows7-x64

10

1cbb1d0d8f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1cbb1d0d8f45beadd900c675d2f0e50d_JaffaCakes118

  • Size

    1.6MB

  • Sample

    240506-qvdq7sdb2z

  • MD5

    1cbb1d0d8f45beadd900c675d2f0e50d

  • SHA1

    d3d999f198e8b009674c9db2e14de493ef9c61d9

  • SHA256

    246fe8f669f674ed1170cbba901fa5609c693b09e4e60bebd54ba07f5a80d035

  • SHA512

    58f0e6b7684d9d6e41dbce5a4bf30e58119bb63cfb3a2636e4aa8161551313aceb16c38f700407ad6e7b090e6dd693bb2b344fe1f6414a8a74275308fb736329

  • SSDEEP

    24576:u4rL+iTBObcQo/8jfFJsJipr2IvskGhPUqf6uCrh9pS9v+Ck7Ow+EVIq8KOd:zLDTylbTq2skS8gRQzmm9qNEG

Score
10/10
raccoonzgratca50de89aeb57a98ef3c6469ed2d76b33aee5eecratstealer

Malware Config

Extracted

Family

raccoon

Botnet

ca50de89aeb57a98ef3c6469ed2d76b33aee5eec

Attributes
  • url4cnc

    https://telete.in/jrubixred

rc4.plain
rc4.plain

Targets

    • Target

      1cbb1d0d8f45beadd900c675d2f0e50d_JaffaCakes118

    • Size

      1.6MB

    • MD5

      1cbb1d0d8f45beadd900c675d2f0e50d

    • SHA1

      d3d999f198e8b009674c9db2e14de493ef9c61d9

    • SHA256

      246fe8f669f674ed1170cbba901fa5609c693b09e4e60bebd54ba07f5a80d035

    • SHA512

      58f0e6b7684d9d6e41dbce5a4bf30e58119bb63cfb3a2636e4aa8161551313aceb16c38f700407ad6e7b090e6dd693bb2b344fe1f6414a8a74275308fb736329

    • SSDEEP

      24576:u4rL+iTBObcQo/8jfFJsJipr2IvskGhPUqf6uCrh9pS9v+Ck7Ow+EVIq8KOd:zLDTylbTq2skS8gRQzmm9qNEG

    Score
    10/10
    raccoonzgratca50de89aeb57a98ef3c6469ed2d76b33aee5eecratstealer

    • Detect ZGRat V1

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V1 payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks