Loading malware…
Raccoon Stealer, also spelled Racoon, is a Windows information stealer distributed through a subscription-based malware-as-a-service operation. It harvests browser passwords, cookies, authentication tokens, autofill information, saved payment-card details, browsing history, and cryptocurrency wallet data. Its stolen logs are traded through cybercriminal marketplaces and can facilitate account takeover and the sale of compromised access. Raccoon targets numerous browsers and applications rather than a single industry.
Raccoon Stealer 2.0 emerged in June 2022 following the operation’s March 2022 shutdown. Initially identified by some researchers as RecordBreaker, this version introduced rewritten C/C++ code and revised service infrastructure. It supports 32-bit and 64-bit Windows systems, retrieves configuration and legitimate supporting libraries from command-and-control infrastructure, and collects system fingerprints and installed-application information. It can also capture screenshots and steal individual files across disks. The configuration specifies targeted applications and supplies information needed for data exfiltration. Version 2.0 transmits collected items individually through HTTP POST requests, enabling theft to proceed incrementally. Raccoon samples have also been protected with Rex3Packer and associated with the BLISTER loader.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Simple server-side cloaking performs the redirect to a Fallout exploit kit landing page which attempts to exploit CVE-2019-0752 (Internet Explorer) and CVE-2018-15982 (Flash Player) before dropping the Raccoon Stealer. | Interestingly, this Smoke Loader instance also downloads Raccoon Stealer and ZLoader.
Simple server-side cloaking performs the redirect to a Fallout exploit kit landing page which attempts to exploit CVE-2019-0752 (Internet Explorer) and CVE-2018-15982 (Flash Player) before dropping the Raccoon Stealer. | Interestingly, this Smoke Loader instance also downloads Raccoon Stealer and ZLoader.
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Analysis showed that the attackers used the technique to distribute Raccoon stealer... They, in particular, used Telegram channels in order to bypass blocking of active C&C servers.
ServHelper is being installed onto the targeted systems using several different mechanisms, ranging from fake installers for popular software to using other malware families such as Raccoon and Amadey as the installation proxies.
Since the beginning of 2019, the Raccoon malware has been offered as malware-as-a-service on various cybercrime forums... In June 2022, a new version of the Raccoon stealer was identified in the wild... Initially, the malware was named “Recordbreaker” but was later identified as a revived version of Raccoon stealer.
Il dépose entre 40 et 50 exécutables ... et installe simultanément plusieurs familles de malwares : Raccoon Stealer v1.7.2 (vol d’informations)
Deux bots infostealer originaires d’Algérie contenant ses identifiants (infectés par Raccoon en septembre 2022 et StealC en février 2024)
GOLD HARVEST is known to employ commodity infostealers such as Vidar and Raccoon, which collect browser-saved passwords, cookies, and session tokens.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
303 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
174 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Identified as malware appearing as a loader or additional component in DarkVision campaigns. Its precise contribution is not detailed.
An information stealer described as extracting cookies, authentication tokens and session IDs that attackers could reuse to hijack authenticated sessions. Its mention is illustrative, not evidence of involvement in Microsoft's account compromise.
A competing information stealer mentioned only for comparison with Vidar.
An information stealer delivered as part of the STANDOFF bundle to steal credentials and other victim data.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.