Malware

Raccoon Infostealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

These individuals used various ruses, such as email phishing, to install the malware onto the computers of unsuspecting victims.

Credential Access

3 techniques

T1056Input CaptureEvidence2

Raccoon Stealer is very popular since it steals a wide range of information from infected devices, such as stored browser credentials and information, credit cards, cryptocurrency wallets, email data, and various other types of sensitive data from numerous applications.

T1555Credentials from Password StoresEvidence1

Raccoon Infostealer then stole personal data from victim computers, including log-in credentials, financial information, and other personal records.

T1649Steal or Forge Authentication CertificatesEvidence1

Since March, the FBI has been collecting some of the data stolen by cybercriminals using the Raccoon Stealer malware from infected computers. "While an exact number has yet to be verified, FBI agents have identified more than 50 million unique credentials and forms of identification..."

Collection

2 techniques

T1005Data from Local SystemEvidence1

T1056Input CaptureEvidence2

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

us department of justiceNews

Oct 25, 2022

Western District of Texas | Newly Unsealed Indictment Charges Ukrainian National with International Cybercrime Operation | United States Department of Justice

An infostealer operated as a malware-as-a-service platform that was leased to criminals for about $200 per month and used to steal login credentials, financial information, and other personal records from victim computers. The stolen data was then used for financial crimes or sold on cybercrime forums.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Raccoon Infostealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

These individuals used various ruses, such as email phishing, to install the malware onto the computers of unsuspecting victims.

Credential Access

3 techniques

T1056Input CaptureEvidence2

T1555Credentials from Password StoresEvidence1

Raccoon Infostealer then stole personal data from victim computers, including log-in credentials, financial information, and other personal records.

T1649Steal or Forge Authentication CertificatesEvidence1

Collection

2 techniques

T1005Data from Local SystemEvidence1

T1056Input CaptureEvidence2

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

us department of justiceNews

Oct 25, 2022

Western District of Texas | Newly Unsealed Indictment Charges Ukrainian National with International Cybercrime Operation | United States Department of Justice

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.