Raccoon

Raccoon is an info stealer type malware available as a Malware as a Service. It can be obtained for a subscription and costs $200 per month. Raccoon malware has already infected over 100,000 devices and became one of the most mentioned viruses on the underground forums in 2019.

Type
Stealer
Origin
ex-USSR
First seen
1 February, 2019
Last seen
5 May, 2022
Also known as
Mohazo
Racealer
Global rank
18
Week rank
43
Month rank
42
IOCs
3404

Raccoon is an information stealer malware — a virus that threat actors use to retrieve sensitive data from infected machines. Also known as Mohazo and Racealer, this is a modern malware that was first sighted in 2019.

Although some consider this a relatively basic malware, excellent service from creators, who distribute it as malware as a service and a user-friendly, simplistic dashboard, helped make Raccoon quite popular. In fact, the malware has already managed to infect upwards of 100,000 devices and became one of the most mentioned viruses in hacker communities.

General description of Raccoon malware

Raccoon malware comes with fairly basic info stealer functions like RedLine and by itself lacks any kind of antivirus protection. There are also no functions that would complicate the analysis of the malware. However, Raccoon developers do suggest using a third-party crypter.

When it comes to the core functionality this virus depending on the configuration enabled by an attacker, can check system settings, capture screenshots, collect basic information like OS version, IP and username and steal passwords and logins from a variety of browsers. On top of that, the stealer can retrieve information from Microsoft Outlook as well as steal cryptocurrency wallets.

When the data collection process ends the data is packed into a .ZIP archive that is then sent to the attackers' server.

The functions described above are rather basic, however, reportedly excellent service provided by the malware creators helped make this virus quite popular. The team behind this virus pushes out constant improvements and fixes based on user feedback.

By providing an easy-to-use dashboard Raccoon developers ensured that even non-technically savvy attackers can operate this malware successfully by customizing its configurations effortlessly. Hundreds of thousands of infected victims in a matter of months since the malware’s release is the result.

Speaking of the team behind Raccoon. The identities of the people behind this virus are a mystery, but some known members of the hacker community are known to have connections with this virus. Evidence suggests that one of the people behind Raccoon is known in the online community as glad0ff. A long known hacker who is responsible for the development of multiple malicious programs like crypto miners and RATs.

However, he does not seem to be working alone as some information about the disputes within the team has been leaked online. For instance, in one message an individual accuses someone-else from the of stealing from a common account, leaving the project, and attempting to scam customers.

There is also reason to believe that Raccoon was developed by Russian-speaking hackers. This is suggested by mistakes in the English language found in the control panel as well as the fact that the malware stops execution if it detects that the victim is from Russia, Ukraine, Belarus, Kazakhstan, Kyrgyzstan, Armenia Tajikistan, or Uzbekistan. In addition, technical support is available in Russian and English languages, which also points to a potential x-USSR origin of the attackers.

Raccoon malware analysis

A video available in the ANY.RUN malware hunting service shows how a machine gets infected with Raccoon in real-time.

raccoon_process_graph

Figure 1: Here we can see the execution process of Raccoon. This graph was created in ANY.RUN.

racoon_text_report

Figure 2: Shows a text report that can help collect data about the malware execution in one place or make a presentation.

Raccoon execution process

Since Raccoon malware is a pretty standard example of a stealer-type malware, its execution process does not exactly stand out. In our analysis case, after the malware made its way into the infected system (does not matter which delivery method it would use) it downloaded additional modules from the Internet. These modules are mostly DLL dependencies which Raccoon requires to work correctly. After that, the malware began stealing information from browsers and the system and stored stolen data in an archive file. The file, in turn, was sent to the C2 server. Probably the same C&C server it was built in. Note that some versions of the Raccoon malware delete themselves after execution while others don't.

Raccoon stealer distribution

Raccoon stealer malware is distributed using multiple channels like browsers, however, the most popular destruction method is through the use of exploit kits. Attackers can even manage campaign configurations via the control panel. The malware utilizes mainly the Fallout exploit kit. This delivery method makes it possible for the infection to occur even without active user interaction — victims get infected while simply surfing the web.

The malware also makes its way to victim’s PCs Microsoft Office document attachments that are being distributed in mail spam campaigns. The contaminated document contains a macro that downloads the malware when enabled.

In addition, hackers have set up a Dropbox account where the malware is stored inside a .IMG file. Attackers use social engineering to trick victims into opening a malicious URL and download the infected file.

Finally, the last distribution method is “bundled malware”. When users download real software from suspicious websites sometimes Raccoon comes as an unwanted part of the package bundled with the legitimate program.

How to detect Raccoon using ANY.RUN?

Some malware creates files in which it named itself. You can find such info about Raccoon malware trojan using ANY.RUN's "Static Discovering". Open either the "Files" tab in the lower part of the task's window or click on the process and then on the button "More Info" in the appeared window. After that, all you need to do is just click on the file.

raccoon_static_discovering

Conclusion

While Raccoon malware is not a very technically advanced malicious program like Ursnif or Hawkeye, Raccoon sure made a lot of noise in the underground community in 2019, when it was first released. Available as a service for $200 per month, it came equipped with everything necessary to start a malware attack. And if a customer couldn’t do it on their own, they could always get support from the team behind this malware.

In fact, underground forums are filled with raving feedback about the excellent work of Raccoon support staff. Some even say that they were treated like real VIPs.

Developers have also shown that they are capable of rolling out updates very quietly and promise to upgrade the malware with Keylogger functionality in the near future.

While technical simplicity makes this threat relatively easy to defend against at the moment, growing popularity, extreme ease of use, and potential future improvement certainly suggest that this malware can become a big phenomenon. Some even say that Raccoon will replace Azorult.

ANY.RUN malware hunting service provides researchers with the ability to study samples of Raccoon in a controlled interactive environment and learn as much as possible about this malware. Hopefully, together we will neutralize or at least medicate the fallout from this and other cybersecurity threats.

IOCs

IP addresses
172.67.158.196
104.21.66.99
172.67.197.203
104.21.8.173
172.67.157.201
194.180.191.44
174.138.11.98
194.180.191.33
185.163.204.81
172.67.208.20
178.23.190.242
194.180.174.41
91.219.236.18
194.180.174.53
188.166.49.196
167.172.35.218
185.225.19.186
185.163.47.176
91.219.236.162
74.119.192.122
Hashes
5e2c211900e145c9aad6d6970858eebbadf07ea9cfb517deae7e5edc66e41cb4
e5c03e8514f40a0fee801c45271adb0a7b9764ac8c116fe3f6209247338413b8
93be2512a5e12fe915c09f92f31b71d55d9fc7a7b5ac95066e120faf3b901419
b0d1ea13046339d248d0ee19584af73c2d34aae37bfd9a3bfeada6e7cef0fc18
32c407abc5d07592bbb8bf9d5866b88e240a5aa740ad2fef388a316887af8fe9
bab33596106fd683cb7190eedfb32a219fffc5691bed72c151893b3270f06c09
cd223a1fe502507e806be32501cb8d98bf661ae2c02c6a0ae9be3d5c3ce4aa95
3c072e8447a090783007f41a0293c619b455742d4d1b35011eb112a1b8cc2e12
27493ca87c0d633bb9b3aace9664110c1a54cb56fd11d9fceae21f2b370de9cc
2eef8577617e660b457890db4c6c8b914508725fd7dba90a47708ae9629fd51c
00f6bff1ff217479f31a0f7e95079e836d5db24e06dfeb10eb907019e80d52a1
3543e12ba052f3669568ec2d3230888789495d2e07d6486c79f5884e418c8cda
48160a7b32d933414246f5e2143e4921b27961588e07a56b98df65161b40377c
fd7b01818107ade3811fe5070491ef2a4bb208ca68bb07710f5c540e44a1e97b
e6cea1416d3647f601b5967f91f5452f9ecfd759661588f5acf1ee87e2652dbd
c169ed7a1989da5c55178881231063ecfe626c3b1dabe3704f646147d85ed44d
804cc9e39d3a85a238d99b929bb7a3b00bca29b9945e2909aaa7f2941dff10b4
2ff1b440f954bf8779f8c0ddfc88bb6fc0e095bd176ad4606f81d006a8634d3f
9eb980a3a65d550661eea3c2de5c763af6993f4da16ffc0aa80202a48748d231
fd0ca4ef0a7dd54815563fdc8a3ef4667c3946cfc7c8c1372414b73786d0a810
Domains
telegka.top
telegatt.top
booking.msg.bluhotels.com
booking.msg.bluhotels.com
ticket.ipv10.eu
3jkpvk2m8y.dattolocal.net
device-local-3193b8ff-0889-41c5-8fd6-67066f88b277.remotewd.com
majul.com
vcctggqm3t.dattolocal.net
192-168-100-240.otmn.direct.quickconnect.to
192-168-100-240.otmn.direct.quickconnect.to
elx01.knas.systems
isns.net
njxyro.ddns.net
qxq.ddns.net
192-168-100-87.abcdefghijklmnopqrstuvwxyz012345.plex.direct
krupskaya.com
m-onetrading-jp.com
thuocnam.tk
xsharenode.com

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control the PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server.
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Crimson RAT screenshot
Crimson RAT
crimson rat trojan
Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild, this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More