Raccoon StealerMalware
Raccoon Stealer is an information stealer malware family active since at least 2019 as a malware-as-a-service offering sold in underground forums. Raccoon Stealer has experienced two periods of activity across two variants, from 2019 to March 2022, then resurfacing in a revised version in June 2022.From MITRE ATT&CK
Last reported 5 years ago, by Group-IB1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1056.001Keylogging
“Keylogging”
What the reports say
1 report, newest first · the exact sentence from each-
The footprints of Raccoon“Raccoon Stealer collects system information, account data, bank card data, and autofill form details from browsers (Google Chrome, Mozilla Firefox, Opera, etc.).”
Indicators in its reports
named in the reports above- co[.]zain 1 report
- documents-cloud-server.co[.]zain 1 report
- b1799345152f0f11…a1867d64e119in 1 report
- hxxp://cloudupdate.co[.]za/documents/msofficeupdate.exein 1 report
- cloudupdate.co[.]zain 1 report
- f3498ba783b9c8c8…d2ff189615d9in 1 report
- badlandsparks[.]comin 1 report
- 185.244.149[.]100in 1 report
- 13b7afe8ee87977a…ca7efd62b9b6in 1 report
- 596a3cb4d82e6ab4…14b0f7bd14afin 1 report
- gineuter[.]infoin 1 report
- fastandprettycleaner[.]hkin 1 report
- c2f8d217877b1a28…5212f8dc2335in 1 report
- hxxp://download-plugin.co[.]za/documents/msofficeupdate.exein 1 report
- download-plugin.co[.]zain 1 report
- 430a406f2134b489…da11a172a7e1in 1 report
- hxxp://msupdater.co[.]za/documents/msofficeupdate.exein 1 report
- msupdater.co[.]zain 1 report
- 160.119.253[.]53in 1 report
- hxxp://www.documents-cloud-server.co[.]za/file_d/adobe-reader-update-10.21.01.exein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.