RaccoonMalware
- mohazo
- raccoonstealer
- racealer
- racoon
Raccoon Stealer is a malware reportedly sold for $75 a week or $200 a month. It gathers personal information including passwords, browser cookies and autofill data, as well as cryptowallet details. Additionally, Raccoon Stealer records system information such as IP addresses and geo-location data.From MISP Galaxy
Last reported 12 days ago, by Sekoia.io5 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1218.002Control Panel
“| PowerCPL.DLL | Power Options Control Panel |”
- T1027.009Embedded Payloads
“…tion options, obfuscation, and anti-analysis tricks) as well as provide a configuration extractor that can be used to dump BLISTER embedded payloads.”
- T1036.012Browser Fingerprint
“…zed in 2023) was invitation-only, and it included an interface that allowed cybercriminals to browse stolen data by location, IP, browser fingerprint, or otherwise.”
- T1055Process Injection
“Own Process Injection”
- T1055.012Process Hollowing
“Process Hollowing”
- T1056.001Keylogging
“Keylogging”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Introducing Sekoia Digital Risk: Track Identity-Led Breaches“Families like Lumma, RedLine, Vidar and Raccoon infect millions of machines a year, mostly personal devices, and harvest every saved password, every active browser session and every autofill record.”
-
The Adversary We Are Fighting Is Now a Full-Force Industry: Inside cybercrime’s new economy“Procurement: Buys pre-stolen logins and device footprints from stealer log markets (RedLine, Lumma, Vidar, Raccoon).”
-
Infostealers Crash Course: A Tradecraft Tuesday Recap“Soon, the true industrialization of infostealers began to take form, with power players like Raccoon, Vidar, and RedLine being built out.”
-
BLISTER Loader“…dition, Elastic has also observed BLISTER in relation to the following families: Amadey, BitRAT, Clipbanker, Cobalt Strike, Remcos, and Raccoon along with others.”
-
The footprints of Raccoon“The footprints of Raccoon”
Indicators in its reports
named in the reports above- afb77617a4ca6376…a731d80832c2in 1 report
- co[.]zain 1 report
- documents-cloud-server.co[.]zain 1 report
- b1799345152f0f11…a1867d64e119in 1 report
- hxxp://cloudupdate.co[.]za/documents/msofficeupdate.exein 1 report
- cloudupdate.co[.]zain 1 report
- f3498ba783b9c8c8…d2ff189615d9in 1 report
- badlandsparks[.]comin 1 report
- 185.244.149[.]100in 1 report
- 13b7afe8ee87977a…ca7efd62b9b6in 1 report
- 596a3cb4d82e6ab4…14b0f7bd14afin 1 report
- gineuter[.]infoin 1 report
- fastandprettycleaner[.]hkin 1 report
- c2f8d217877b1a28…5212f8dc2335in 1 report
- hxxp://download-plugin.co[.]za/documents/msofficeupdate.exein 1 report
- download-plugin.co[.]zain 1 report
- 430a406f2134b489…da11a172a7e1in 1 report
- hxxp://msupdater.co[.]za/documents/msofficeupdate.exein 1 report
- msupdater.co[.]zain 1 report
- 160.119.253[.]53in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.