This information-stealing trojan malware is quickly gaining popularity among cyber criminals

mood · Oct 24, 2019

This easy-to-use information-stealing trojan malware is quickly gaining popularity among cyber criminals
Racoon Stealer isn't sophisticated, but it has stolen credit card information, passwords and more from hundreds of thousands of victims
October 24, 2019
https://www.zdnet.com/article/this-...kly-gaining-popularity-among-cyber-criminals/

A new kind of easy to use trojan malware is gaining popularity among cyber criminals, providing them with simple means of stealing credit card data, passwords and cryptocurrency -- and it has already infected hundreds of thousands of Windows users around the world.
Raccoon Stealer first appeared in April this year and has quickly risen to become one of the most talked-about malware services in underground forums.

Researchers at Cybereason have been monitoring Raccoon since it first emerged, and note that while not sophisticated, it is aggressively marketed to potential criminal users, providing them with an easy-to-use back end, along with bulletproof hosting and 24/7 support -- all for $200 a month.
Raccoon's flexible nature allows it to be delivered to victims in a number of ways, but it's most often distributed via exploit kits, phishing and compromised software downloads.
Click to expand...

Cybereason: Hunting Raccoon: The New Masked Bandit on the Block

mood · Nov 22, 2019

Raccoon Stealer Malware Scurries Past Microsoft Messaging Gateways
November 22, 2019
https://threatpost.com/raccoon-stealer-malware-scurries-past-microsoft-messaging-gateways/150545/

Criminals behind malware dubbed Raccoon Stealer have adopted a simple and effective technique to circumvent Microsoft and Symantec anti-spam messaging gateways.

According to a Cofense report posted Thursday, the malware is delivered inside an .IMG file hosted on a hacker-controlled Dropbox account.

“Using the familiar theme of a wire transfer—closely akin to those often seen in business email compromise scams—the threat actors look to trick users into opening the Dropbox URL and downloading the malicious file,” wrote Cofense authors Max Gannon and Alan Rainer.
What makes the Raccoon Stealer interesting to researchers is that it is new, easy-to-use and under active development by the hackers behind it. Cofense said the malware was first spotted in April of 2019 and since then has been leveraged in several different campaigns.
Click to expand...

Because of the malware’s flexibility to deliver a variety of payloads the Raccoon Stealer is gaining traction in underground markets, said researchers.

“Given the variety of delivery options, Raccoon Stealer could be a problem for organizations that focus too much on one infection vector,” Cofense researchers said.
Click to expand...

Cofense: Raccoon Stealer Found Rummaging Past Symantec and Microsoft Gateways

mood · Feb 24, 2020

Raccoon Malware Steals Your Data From Nearly 60 Apps
February 24, 2020
https://www.bleepingcomputer.com/news/security/racoon-malware-steals-your-data-from-nearly-60-apps/

An infostealing malware that is relatively new on cybercriminal forums can extract sensitive data from about 60 applications on a targeted computer.
Unsophisticated yet good enough
Also known as Legion, Mohazo, and Racealer, the malware was initially promoted only on Russian-speaking forums but it soon made its entrance in the English-speaking space. The malware was first seen in the wild April 2019 and it is distributed under the MaaS (malware-as-a-service) model for $75/week or $200/month.

An analysis from CyberArk found that it is written in C++ and is far from being a complex tool. However, it can steal sensitive and confidential information from almost 60 programs (browsers, cryptocurrency wallets, email and FTP clients).
Additional capabilities in the malware include collecting system details (OS version and architecture, language, hardware info, enumerate installed apps).

"After fulfilling all his stealing capabilities, it gathers all the files that it wrote to temp folder into one zip file named Log.zip. Now all it has to do is send the zip file back to the C&C server and delete its trace" - CyberArk
Click to expand...

CyberArk: Raccoon: The Story of a Typical Infostealer

Minimalist · Mar 10, 2020

Malware Spread as Nude Extortion Pics of Friend's Girlfriend

Attackers have recently warped sextortion scams into baits used to infect their targets with Raccoon information stealer malware designed to help steal credentials, credit card information, desktop cryptocurrency wallets, and more.
Click to expand...

https://www.bleepingcomputer.com/ne...as-nude-extortion-pics-of-friends-girlfriend/

mood · Apr 1, 2020

New Raccoon Stealer uses Google Cloud Services to evade detection
April 1, 2020
https://securityaffairs.co/wordpress/100869/malware/raccoon-abuses-google-services.html

Racoon malware (aka Legion, Mohazo, and Racealer) is an info-stealer that recently appeared in the threat landscape that is advertised in hacking forums.
The malware is cheap compared to similar threats, it is able to steal sensitive data from about 60 applications, including (browsers, cryptocurrency wallets, email and FTP clients).

“Once the Raccoon malware infects a machine, it connects to a Google Drive URL to decrypt the actual C&C server. The format of the URL is hxxp://{IP}/gate/log.php, which logs the computer configuration information. Then, it will receive a JSON-formatted file containing the location dependencies. Next, it will connect to URL hxxp://{IP}/file_handler/file.php for data exfiltration.” reads the analysis published by Trend Micro.
The malware was distributed also via malspam emails, the messages used an attachment that drops the Raccoon malware (TrojanSpy.Win32.RACEALER.M) and their content claimed that the recipient’s friend had their email hacked. The messages attempt to blackmail the recipient demanding money in exchange for the stolen sensitive information they claim to have stolen.
Click to expand...

Since April 2019, experts already detected more than 100,000 raccoon related events, with a peak in detections in July 2019. Experts identified over 3,000 unique binary samples of the Raccoon “Racestealer” stealer since the second quarter of 2019, they pointed out that operators behind the MaaS continue to release new versions of the malware.

“The current activity of the Raccoon malware seems to indicate that its development and use by threat actors will continue. The next best move for its creators would likely be to improve and fix some of its bugs, and then add new techniques to its relatively basic repertoire.” concludes Trend Micro.
Click to expand...

Trend Micro: Raccoon Stealer’s Abuse of Google Cloud Services and Multiple Delivery Techniques

Raccoon emerged as Malware as a Service (MaaS) last April 2019. Despite its simplicity, Raccoon became popular among cybercriminals and was mentioned as a notable emerging malware in underground forums in a malware popularity report.

It can arrive on a system through different delivery techniques such as exploit kits, phishing, and bundled with other malware. In this blog entry we investigate campaigns that used the exploit kits Fallout and Rig, where we also observed its use of Google Drive as part of its evasion tactics.
Click to expand...

mood · Apr 9, 2020

Malvertising campaign spoofs Malwarebytes website to deliver Raccoon info-stealer
April 9, 2020
https://www.scmagazine.com/home/sec...ytes-website-to-deliver-raccoon-info-stealer/

Malicious actors created a fake webpage that impersonates cybersecurity company Malwarebytes and were using it as a gateway in a malvertising campaign designed to infect victims with the Raccoon information stealer.
The malicious page, located at malwarebytes-free[.]com, in turn routes victims to the Fallout Exploit Kit, which enables the Raccoon infection.

The malicious domain was registered on March 29 and is hosted in Russia, Malwarebytes reported in a Tuesday blog post. The fake website announces the availability of Malwarebytes 4.0 for Windows, and purports to offer a free download. The company believes the threat actor may be tied to similar campaigns from the past few months that used similar copycat templates of websites as gates.

“Examining the source code, we can confirm that someone stole the content from our original site but added something extra,” the blog post states. “A JavaScript snippet checks which kind of browser you are running, and if it happens to be Internet Explorer, you are redirected to a malicious URL belonging to the Fallout exploit kit.”
Click to expand...

Malwarebytes: Copycat criminals abuse Malwarebytes brand in malvertising campaign

Copycat tactics have long been used by scammers and other criminals to dupe online and offline victims. As always, it is better to double-check the identity of the website you are visiting and, if in doubt, access it directly either by punching in the URL or via bookmarked page/tab.
Click to expand...

mood · Aug 4, 2021 at 7:15 AM

Raccoon Stealer Bundles Malware, Propagates Via Google SEO
An update to the stealer-as-a-service platform hides in pirated software, pilfers crypto-coins and installs a software dropper for downloads of more malware
August 3, 2021
https://threatpost.com/raccoon-stealer-google-seo/168301/

Criminals behind the Raccoon Stealer platform have updated their services to include tools for siphoning cryptocurrency from a target’s computer and new remote access features for dropping malware and scooping up files.

The stealer-as-a-service platform, whose customers are typically rookie hackers, offers turnkey services for pilfering browser-stored passwords and authentication cookies. According to new research from Sophos Labs published Tuesday, the platform has received a noteworthy update that includes new tools and distribution networks to boost infected targets.
Click to expand...

For starters, Raccoon Stealer has pivoted from inbox-based infections to ones that leverage Google Search. According to Sophos, threat actors have been proficient in their optimization of malicious web pages to rank high in Google search results.
Raccoon Learns New Tricks Delivers New Misery
What is unique about Raccoon Stealer is that, unlike other info-stealer services and malware targeting individuals via inboxes, the campaign Sophos tracked is distributed via malicious websites.
Click to expand...

Sophos: Trash Panda as a Service: Raccoon Stealer steals cookies, cryptocoins, and more

This Raccoon Stealer campaign is indicative of how industrialized criminal activity has become. Using a collection of paid services—the dropper-as-a-service to deploy Raccoon, in addition to the stealer-as-a-service Raccoon itself, and what may be an underlying malware hosting-as-a-service underlying all of these components—the actor behind this Raccoon campaign was able to

deploy malware

steal cookies and credentials

sell those stolen credentials on criminal marketplaces

steal approximately $13,200 US worth of cryptocurrency, and use the compute resources of victims to mine another $2,900 in cryptocurrency over a 6-month period.

Click to expand...

Log in or Sign up

This information-stealing trojan malware is quickly gaining popularity among cyber criminals

mood Updates Team

mood Updates Team

mood Updates Team

Minimalist Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

Log in or Sign up

This information-stealing trojan malware is quickly gaining popularity among cyber criminals

mood Updates Team

mood Updates Team

mood Updates Team

Minimalist Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

Useful Searches