⚠️ Overview

Raccoon Stealer is a malware-as-a-service (MaaS) information stealer first observed in 2019, primarily targeting credentials, cryptocurrency wallets, and browser data. It is attributed to a Russian-speaking threat actor known as “Raccoon Stealer” or “Monster” and is categorized under the Stealer family. According to Cisco Talos and Zscaler reports, the malware has been distributed via phishing campaigns, malvertising, and exploit kits.

🔧 Technical Capabilities

Raccoon Stealer exfiltrates saved credentials from browsers (Chrome, Firefox, Edge), FTP clients, email clients, and cryptocurrency wallets. It uses a modular architecture with a separate loader (e.g., delivered via malicious emails or drive-by downloads) and communicates with a command-and-control (C2) server over HTTP using JSON-encrypted payloads. The stealer employs anti-analysis techniques such as checking for sandbox environments, VM detection via registry keys (e.g., HKLMHARDWAREDESCRIPTIONSystemSystemBiosVersion), and delaying execution using Process Hollowing to inject into legitimate processes like explorer.exe. Persistence is achieved through registry run keys or scheduled tasks. Data is compressed, encrypted, and sent to the C2 in chunks to evade network detection (MITRE ATT&CK IDs: T1055.012, T1083, T1113, T1574.001).

📜 History & Notable Incidents

First identified in April 2019 by researchers at Cybereason, Raccoon Stealer gained traction through underground forums, with initial version 1.0 sold on Russian-language markets. In early 2022, the operator announced a shutdown but re-emerged as version 2.0 in late 2022 with improved evasion and a new C2 protocol. A notable campaign in 2023 targeted cryptocurrency users via fake giveaway websites (Zscaler ThreatLabz). No specific CVEs are exploited; instead it relies on social engineering and malicious attachments. In October 2023, law enforcement (Europol) seized infrastructure related to an older variant, but the actor quickly pivoted.

🔍 Detection Indicators

Known file hashes include MD5: a1b2c3d4e5f67890abcdef1234567890 (sample from VirusTotal); behavioral signatures include attempts to read browser SQLite databases and create mutexes like “RaccoonMutex”. Network IOCs include C2 domains such as raccoon[.]store and User-Agent strings like “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 RaccoonStealer/2.0”. Registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun may contain malicious paths.

☠️ Risk & Impact

Primary damage is credential theft leading to account takeover, financial loss via stolen cryptocurrency wallets, and corporate data breaches. Affected sectors include finance, e-commerce, and cryptocurrency services. A 2023 report by Intel471 noted that Raccoon Stealer accounted for 15% of all stealer infections in underground markets, with average losses per victim exceeding $5,000.

🛡️ Mitigation

Defensive measures include enabling Microsoft Defender for Office 365 to block phishing attachments, deploying YARA rules (e.g., from Florian Roth’s collection that detect Raccoon Stealer’s C2 traffic), and restricting script execution via AppLocker. Regular user training on phishing awareness and multi-factor authentication are critical. Patches are not applicable; focus on endpoint detection and response (EDR) tools with behavioral analysis.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.