BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details
19
Global rank
38 infographic chevron month
Month rank
35 infographic chevron week
Week rank
1073
IOCs

Raccoon is an info stealer type malware available as a Malware as a Service. It can be obtained for a subscription and costs $200 per month. Raccoon malware has already infected over 100,000 devices and became one of the most mentioned viruses on the underground forums in 2019.

Stealer
Type
ex-USSR
Origin
1 February, 2019
First seen
20 May, 2024
Last seen
Also known as
Mohazo
Racealer

How to analyze Raccoon with ANY.RUN

Type
ex-USSR
Origin
1 February, 2019
First seen
20 May, 2024
Last seen

IOCs

IP addresses
193.222.96.7
94.142.138.147
185.193.125.199
194.87.31.58
5.78.80.43
5.78.81.39
157.90.161.111
89.23.107.183
93.115.22.159
93.115.22.165
Hashes
f47935627a5be41526be384d115b1f291d854063d0b31bee2c9c11dc65695438
c5e67f5be47902fe451ee2a40f1eb75e1653b40e0776bd97b1ad58215dc87ff7
e5c03e8514f40a0fee801c45271adb0a7b9764ac8c116fe3f6209247338413b8
38428ed69bfa018b637002f8d4c4680a8c6765cf941449de018971b5bfaeb179
8d5f481be0bb03f0e59effda0fc86a0c9a7da2fb8964f2b4d00530f24231fc7c
4ecd72df3bf87cfbe2ff7429d69cb77d667f196dbbae1c87beb827d1049c9cf2
db926403044468770e30a5d653fb83c5b262f91682ce6553ee32287c02753c4f
39c28f0244bfeb2fe54808cda05f80ad36a886f1e2c75960779ede0894a9219d
2b967e3434b98b3f608aea7918c69301a341981022118818df4c10e4456086ae
21df0ff4710ab3ea44a1950745f9c71f3098bce46c5b0a7e86ba2777810ae855
ff989b153b083f9b8a93e87b8f0967bf6bac14403952d901b331f96b15f9b5a9
3fd8bd0db5fe95ff75e988a57e3be798b24cbf538f96aaefbf53ce6afa2c73a0
71d51b419c2380ef596a3a682ac1da9e992e3ed4cb8722fb942ba84807df03c4
eeb5ee631e4e3dea3a6faf8fc70bf52d1814db8f5c6a6ebe729ae23df71879e5
078df4c79d3e962bb61bf86cb8cb4c93c99ff66f5cfdb86c97e08172c86907c2
2513cf6aa56a6fb9c84061ac04c8df3e225258638f9f0d40ce898a9096f93e9b
86fe9003f73a6e14ab963d44545134e1cbd72755934266a95566cea4cfe84c16
9b02821469651d4ae281e555846271dc2a946a0627b5098c5da0e9ad6b6eda4e
5320425988b0670455042dbd99d0c30b96ddf4710932dbe61b95711b185536b6
0521e7e051a7891ce07faea0d24f9881b1d30c1eb48c5fe87816a6b1a1dcfc91
Domains
mehranschool.org
URLs
http://193.142.147.59:80/
http://195.20.16.155:80/
http://192.227.94.170:80/
http://89.238.170.230:80/
http://91.107.239.231:80/
http://46.151.31.26:80/
http://82.146.45.177:80/
http://193.233.132.204:80/
http://45.153.230.5/
http://5.252.23.112/
http://94.131.106.24:80/
http://195.20.16.127:80/
http://195.2.81.45:80/
http://193.222.96.7:8787/
http://41.216.183.87:80/
http://45.14.244.72:80/
http://194.116.173.154:80/
http://185.16.39.253:80/
http://195.20.16.226:80/
http://62.113.114.93:80/
Last Seen at

Recent blog posts

post image
ANY.RUN attends Osintomático 2024
watchers 54
comments 0
post image
Windows 11 UAC Bypass in Modern Malware
watchers 768
comments 0
post image
New Hijack Loader Variant: Uses Process Hollo...
watchers 573
comments 0

Raccoon is an information stealer malware — a virus that threat actors use to retrieve sensitive data from infected machines. Also known as Mohazo and Racealer, this is a modern malware that was first sighted in 2019.

Although some consider this a relatively basic malware, excellent service from creators, who distribute it as malware as a service and a user-friendly, simplistic dashboard, helped make Raccoon quite popular. In fact, the malware has already managed to infect upwards of 100,000 devices and became one of the most mentioned viruses in hacker communities.

General description of Raccoon malware

Raccoon malware comes with fairly basic info stealer functions like RedLine and by itself lacks any kind of antivirus protection. There are also no functions that would complicate the analysis of the malware. However, Raccoon developers do suggest using a third-party crypter.

When it comes to the core functionality this virus depending on the configuration enabled by an attacker, can check system settings, capture screenshots, collect basic information like OS version, IP and username and steal passwords and logins from a variety of browsers. On top of that, the stealer can retrieve information from Microsoft Outlook as well as steal cryptocurrency wallets.

When the data collection process ends the data is packed into a .ZIP archive that is then sent to the attackers' server.

The functions described above are rather basic, however, reportedly excellent service provided by the malware creators helped make this virus quite popular. The team behind this virus pushes out constant improvements and fixes based on user feedback.

By providing an easy-to-use dashboard Raccoon developers ensured that even non-technically savvy attackers can operate this malware successfully by customizing its configurations effortlessly. Hundreds of thousands of infected victims in a matter of months since the malware’s release is the result.

Get started today for free

Easily analyze emerging malware with ANY.RUN interactive online sandbox

Register for free

Speaking of the team behind Raccoon. The identities of the people behind this virus are a mystery, but some known members of the hacker community are known to have connections with this virus. Evidence suggests that one of the people behind Raccoon is known in the online community as glad0ff. A long known hacker who is responsible for the development of multiple malicious programs like crypto miners and RATs.

However, he does not seem to be working alone as some information about the disputes within the team has been leaked online. For instance, in one message an individual accuses someone-else from the of stealing from a common account, leaving the project, and attempting to scam customers.

There is also reason to believe that Raccoon was developed by Russian-speaking hackers. This is suggested by mistakes in the English language found in the control panel as well as the fact that the malware stops execution if it detects that the victim is from Russia, Ukraine, Belarus, Kazakhstan, Kyrgyzstan, Armenia Tajikistan, or Uzbekistan. In addition, technical support is available in Russian and English languages, which also points to a potential x-USSR origin of the attackers.

Raccoon malware analysis

A video available in the ANY.RUN malware hunting service shows how a machine gets infected with Raccoon in real-time.

Read a detailed analysis of Raccoon Stealer 2.0 in our blog.

raccoon_process_graph

Figure 1: Here we can see the execution process of Raccoon. This graph was created in ANY.RUN.

racoon_text_report

Figure 2: Shows a text report that can help collect data about the malware execution in one place or make a presentation.

Raccoon execution process

Since Raccoon malware is a pretty standard example of a stealer-type malware, its execution process does not exactly stand out. In our analysis case, after the malware made its way into the infected system (does not matter which delivery method it would use) it downloaded additional modules from the Internet. These modules are mostly DLL dependencies which Raccoon requires to work correctly. After that, the malware began stealing information from browsers and the system and stored stolen data in an archive file. The file, in turn, was sent to the C2 server. Probably the same C&C server it was built in. Note that some versions of the Raccoon malware delete themselves after execution while others don't.

Raccoon stealer distribution

Raccoon stealer malware is distributed using multiple channels like browsers, however, the most popular destruction method is through the use of exploit kits. Attackers can even manage campaign configurations via the control panel. The malware utilizes mainly the Fallout exploit kit. This delivery method makes it possible for the infection to occur even without active user interaction — victims get infected while simply surfing the web.

The malware also makes its way to victim’s PCs Microsoft Office document attachments that are being distributed in mail spam campaigns. The contaminated document contains a macro that downloads the malware when enabled.

In addition, hackers have set up a Dropbox account where the malware is stored inside a .IMG file. Attackers use social engineering to trick victims into opening a malicious URL and download the infected file.

Finally, the last distribution method is “bundled malware”. When users download real software from suspicious websites sometimes Raccoon comes as an unwanted part of the package bundled with the legitimate program.

How to detect Raccoon using ANY.RUN?

Some malware creates files in which it named itself. You can find such info about Raccoon malware trojan using ANY.RUN's "Static Discovering". Open either the "Files" tab in the lower part of the task's window or click on the process and then on the button "More Info" in the appeared window. After that, all you need to do is just click on the file.

raccoon_static_discovering

Conclusion

While Raccoon malware is not a very technically advanced malicious program like Ursnif or Hawkeye, Raccoon sure made a lot of noise in the underground community in 2019, when it was first released. Available as a service for $200 per month, it came equipped with everything necessary to start a malware attack. And if a customer couldn’t do it on their own, they could always get support from the team behind this malware.

In fact, underground forums are filled with raving feedback about the excellent work of Raccoon support staff. Some even say that they were treated like real VIPs.

Developers have also shown that they are capable of rolling out updates very quietly and promise to upgrade the malware with Keylogger functionality in the near future.

While technical simplicity makes this threat relatively easy to defend against at the moment, growing popularity, extreme ease of use, and potential future improvement certainly suggest that this malware can become a big phenomenon. Some even say that Raccoon will replace Azorult.

ANY.RUN malware hunting service provides researchers with the ability to study samples of Raccoon in a controlled interactive environment and learn as much as possible about this malware. Hopefully, together we will neutralize or at least medicate the fallout from this and other cybersecurity threats.

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More

Our website uses cookies. By visiting the pages of the site, you agree to our Privacy Policy