This information-stealing trojan malware is quickly gaining popularity among cyber criminals

mood · Oct 24, 2019

This easy-to-use information-stealing trojan malware is quickly gaining popularity among cyber criminals
Racoon Stealer isn't sophisticated, but it has stolen credit card information, passwords and more from hundreds of thousands of victims
October 24, 2019
https://www.zdnet.com/article/this-...kly-gaining-popularity-among-cyber-criminals/

A new kind of easy to use trojan malware is gaining popularity among cyber criminals, providing them with simple means of stealing credit card data, passwords and cryptocurrency -- and it has already infected hundreds of thousands of Windows users around the world.
Raccoon Stealer first appeared in April this year and has quickly risen to become one of the most talked-about malware services in underground forums.

Researchers at Cybereason have been monitoring Raccoon since it first emerged, and note that while not sophisticated, it is aggressively marketed to potential criminal users, providing them with an easy-to-use back end, along with bulletproof hosting and 24/7 support -- all for $200 a month.
Raccoon's flexible nature allows it to be delivered to victims in a number of ways, but it's most often distributed via exploit kits, phishing and compromised software downloads.
Click to expand...

Cybereason: Hunting Raccoon: The New Masked Bandit on the Block

mood · Nov 22, 2019

Raccoon Stealer Malware Scurries Past Microsoft Messaging Gateways
November 22, 2019
https://threatpost.com/raccoon-stealer-malware-scurries-past-microsoft-messaging-gateways/150545/

Criminals behind malware dubbed Raccoon Stealer have adopted a simple and effective technique to circumvent Microsoft and Symantec anti-spam messaging gateways.

According to a Cofense report posted Thursday, the malware is delivered inside an .IMG file hosted on a hacker-controlled Dropbox account.

“Using the familiar theme of a wire transfer—closely akin to those often seen in business email compromise scams—the threat actors look to trick users into opening the Dropbox URL and downloading the malicious file,” wrote Cofense authors Max Gannon and Alan Rainer.
What makes the Raccoon Stealer interesting to researchers is that it is new, easy-to-use and under active development by the hackers behind it. Cofense said the malware was first spotted in April of 2019 and since then has been leveraged in several different campaigns.
Click to expand...

Because of the malware’s flexibility to deliver a variety of payloads the Raccoon Stealer is gaining traction in underground markets, said researchers.

“Given the variety of delivery options, Raccoon Stealer could be a problem for organizations that focus too much on one infection vector,” Cofense researchers said.
Click to expand...

Cofense: Raccoon Stealer Found Rummaging Past Symantec and Microsoft Gateways

mood · Feb 24, 2020

Raccoon Malware Steals Your Data From Nearly 60 Apps
February 24, 2020
https://www.bleepingcomputer.com/news/security/racoon-malware-steals-your-data-from-nearly-60-apps/

An infostealing malware that is relatively new on cybercriminal forums can extract sensitive data from about 60 applications on a targeted computer.
Unsophisticated yet good enough
Also known as Legion, Mohazo, and Racealer, the malware was initially promoted only on Russian-speaking forums but it soon made its entrance in the English-speaking space. The malware was first seen in the wild April 2019 and it is distributed under the MaaS (malware-as-a-service) model for $75/week or $200/month.

An analysis from CyberArk found that it is written in C++ and is far from being a complex tool. However, it can steal sensitive and confidential information from almost 60 programs (browsers, cryptocurrency wallets, email and FTP clients).
Additional capabilities in the malware include collecting system details (OS version and architecture, language, hardware info, enumerate installed apps).

"After fulfilling all his stealing capabilities, it gathers all the files that it wrote to temp folder into one zip file named Log.zip. Now all it has to do is send the zip file back to the C&C server and delete its trace" - CyberArk
Click to expand...

CyberArk: Raccoon: The Story of a Typical Infostealer

Minimalist · Mar 10, 2020

Malware Spread as Nude Extortion Pics of Friend's Girlfriend

Attackers have recently warped sextortion scams into baits used to infect their targets with Raccoon information stealer malware designed to help steal credentials, credit card information, desktop cryptocurrency wallets, and more.
Click to expand...

https://www.bleepingcomputer.com/ne...as-nude-extortion-pics-of-friends-girlfriend/

mood · Apr 1, 2020

New Raccoon Stealer uses Google Cloud Services to evade detection
April 1, 2020
https://securityaffairs.co/wordpress/100869/malware/raccoon-abuses-google-services.html

Racoon malware (aka Legion, Mohazo, and Racealer) is an info-stealer that recently appeared in the threat landscape that is advertised in hacking forums.
The malware is cheap compared to similar threats, it is able to steal sensitive data from about 60 applications, including (browsers, cryptocurrency wallets, email and FTP clients).

“Once the Raccoon malware infects a machine, it connects to a Google Drive URL to decrypt the actual C&C server. The format of the URL is hxxp://{IP}/gate/log.php, which logs the computer configuration information. Then, it will receive a JSON-formatted file containing the location dependencies. Next, it will connect to URL hxxp://{IP}/file_handler/file.php for data exfiltration.” reads the analysis published by Trend Micro.
The malware was distributed also via malspam emails, the messages used an attachment that drops the Raccoon malware (TrojanSpy.Win32.RACEALER.M) and their content claimed that the recipient’s friend had their email hacked. The messages attempt to blackmail the recipient demanding money in exchange for the stolen sensitive information they claim to have stolen.
Click to expand...

Since April 2019, experts already detected more than 100,000 raccoon related events, with a peak in detections in July 2019. Experts identified over 3,000 unique binary samples of the Raccoon “Racestealer” stealer since the second quarter of 2019, they pointed out that operators behind the MaaS continue to release new versions of the malware.

“The current activity of the Raccoon malware seems to indicate that its development and use by threat actors will continue. The next best move for its creators would likely be to improve and fix some of its bugs, and then add new techniques to its relatively basic repertoire.” concludes Trend Micro.
Click to expand...

Trend Micro: Raccoon Stealer’s Abuse of Google Cloud Services and Multiple Delivery Techniques

Raccoon emerged as Malware as a Service (MaaS) last April 2019. Despite its simplicity, Raccoon became popular among cybercriminals and was mentioned as a notable emerging malware in underground forums in a malware popularity report.

It can arrive on a system through different delivery techniques such as exploit kits, phishing, and bundled with other malware. In this blog entry we investigate campaigns that used the exploit kits Fallout and Rig, where we also observed its use of Google Drive as part of its evasion tactics.
Click to expand...

mood · Apr 9, 2020

Malvertising campaign spoofs Malwarebytes website to deliver Raccoon info-stealer
April 9, 2020
https://www.scmagazine.com/home/sec...ytes-website-to-deliver-raccoon-info-stealer/

Malicious actors created a fake webpage that impersonates cybersecurity company Malwarebytes and were using it as a gateway in a malvertising campaign designed to infect victims with the Raccoon information stealer.
The malicious page, located at malwarebytes-free[.]com, in turn routes victims to the Fallout Exploit Kit, which enables the Raccoon infection.

The malicious domain was registered on March 29 and is hosted in Russia, Malwarebytes reported in a Tuesday blog post. The fake website announces the availability of Malwarebytes 4.0 for Windows, and purports to offer a free download. The company believes the threat actor may be tied to similar campaigns from the past few months that used similar copycat templates of websites as gates.

“Examining the source code, we can confirm that someone stole the content from our original site but added something extra,” the blog post states. “A JavaScript snippet checks which kind of browser you are running, and if it happens to be Internet Explorer, you are redirected to a malicious URL belonging to the Fallout exploit kit.”
Click to expand...

Malwarebytes: Copycat criminals abuse Malwarebytes brand in malvertising campaign

Copycat tactics have long been used by scammers and other criminals to dupe online and offline victims. As always, it is better to double-check the identity of the website you are visiting and, if in doubt, access it directly either by punching in the URL or via bookmarked page/tab.
Click to expand...

mood · Aug 4, 2021

Raccoon Stealer Bundles Malware, Propagates Via Google SEO
An update to the stealer-as-a-service platform hides in pirated software, pilfers crypto-coins and installs a software dropper for downloads of more malware
August 3, 2021
https://threatpost.com/raccoon-stealer-google-seo/168301/

Criminals behind the Raccoon Stealer platform have updated their services to include tools for siphoning cryptocurrency from a target’s computer and new remote access features for dropping malware and scooping up files.

The stealer-as-a-service platform, whose customers are typically rookie hackers, offers turnkey services for pilfering browser-stored passwords and authentication cookies. According to new research from Sophos Labs published Tuesday, the platform has received a noteworthy update that includes new tools and distribution networks to boost infected targets.
Click to expand...

For starters, Raccoon Stealer has pivoted from inbox-based infections to ones that leverage Google Search. According to Sophos, threat actors have been proficient in their optimization of malicious web pages to rank high in Google search results.
Raccoon Learns New Tricks Delivers New Misery
What is unique about Raccoon Stealer is that, unlike other info-stealer services and malware targeting individuals via inboxes, the campaign Sophos tracked is distributed via malicious websites.
Click to expand...

Sophos: Trash Panda as a Service: Raccoon Stealer steals cookies, cryptocoins, and more

This Raccoon Stealer campaign is indicative of how industrialized criminal activity has become. Using a collection of paid services—the dropper-as-a-service to deploy Raccoon, in addition to the stealer-as-a-service Raccoon itself, and what may be an underlying malware hosting-as-a-service underlying all of these components—the actor behind this Raccoon campaign was able to

deploy malware

steal cookies and credentials

sell those stolen credentials on criminal marketplaces

steal approximately $13,200 US worth of cryptocurrency, and use the compute resources of victims to mine another $2,900 in cryptocurrency over a 6-month period.

Click to expand...

mood · Aug 16, 2021

Malware dev infects own PC and data ends up on intel platform
August 16, 2021
https://www.bleepingcomputer.com/ne...ts-own-pc-and-data-ends-up-on-intel-platform/

A malware developer unleashed their creation on their system to try out new features and the data ended up on a cybercrime intelligence platform, exposing a glimpse of the cybercriminal endeavor.

The threat actor is the developer of Raccoon, an information stealer that can collect data from dozens of applications and has been growing in popularity for the past two years.
Click to expand...

Email and a name, but not enough
While testing a variant of the stealer, the developer of Raccoon infected their own system, a move that immediately triggered the data to flow to the command and control (C2) server and further on, to cybercrime forums.
Raccoon developer’s infected test system was found through Hudson Rock’s Cavalier platform, a cybercrime intelligence database that monitors compromised machines.

The researcher told BleepingComputer that the developer of Raccoon infostealer infected their machine in February but went unnoticed because it presented no interest since it was not a machine belonging to the company’s clients.
Click to expand...

The data collected from the self-infected system shows that the developer tested the malware’s ability to extract passwords from Google Chrome, an essential attribute for any information stealer.
Additional information trawled from the Raccoon test computer revealed a name and multiple email addresses associated with the malware.

Unfortunately, the details are insufficient to determine the identity of Raccoon’s developer. Gal says that the malware creator “likely infected [the machine] on purpose” and was careful enough to remove the details that could reveal who they are before unleashing the malware.
Click to expand...

mood · Jul 25, 2022

Racoon Stealer is Back — How to Protect Your Organization
July 25, 2022

The Racoon Stealer malware as a service platform gained notoriety several years ago for its ability to extract data that is stored within a Web browser.
As bad as Racoon Stealer might have been, its developers have recently created a new version that is designed to be far more damaging than the version that previously existed.
New Racoon Stealer Capabilities
The new version of Raccoon Stealer still has the ability to steal browser passwords, cookies, and auto-fill data. It also has the ability to steal any credit card numbers that are saved in the browser.

Additionally, the latest version of Raccoon Stealer is far more capable than its predecessor when it comes to stealing cryptocurrency. Not only can Raccoon Stealer attack cryptocurrency wallets, but it also has the ability to attack numerous cryptocurrency-related browser plugins.
Click to expand...

The developers of Raccoon Stealer have also enhanced the malware's ability to harvest file data. Whereas the previous version was eventually enhanced to allow the theft of individual files, the latest version is capable of stealing files regardless of which disk they reside.
Click to expand...

Sekoia:
Raccoon Stealer v2 – Part 1: The return of the dead

Raccoon Stealer was one of the most prolific information stealers in 2021, being used by multiple cybercriminal actors. Due to its wide stealing capabilities, the customizability of the malware and its ease of use, Raccoon Stealer was highly popular among threat actors. The malware was mainly distributed using fake installers, or as cracked versions of popular software.

Previously sold as a malware-as-a-service on underground forums since early 2019, its operations suddenly stopped on March 25, 2022.
At the time, the raccoonstealer profile stated on several forums they “don’t say goodbye forever”, and that they were already working on a second version.
Click to expand...

Raccoon Stealer v2 – Part 2: In-depth analysis

This blog post is a technical analysis of the new Raccoon Stealer 2.0 stand-alone version. Authors have announced that the malware is also available in a DLL format or could be embedded in other PE.
Click to expand...

mood · Aug 2, 2022

Credential Stealer Malware Raccoon Updated to Obtain Passwords More Efficiently
August 1, 2022

Security experts from online platform Zscaler have published an analysis of the new variant of the known Raccoon Stealer malware.

Writing in an advisory last Friday, Zscaler said the new version of the malware is written in C, unlike previous versions which were mainly written in C++.
Raccoon Stealer 2.0 features a new back-end and front-end, and code to steal credentials and other data more efficiently.
Click to expand...

The novel version of the credential stealer can also work on 32 and 64-bit systems without the need for any extra dependencies, instead fetching eight legitimate DLLs directly from its C2 servers (instead of relying on Telegram Bot API).

The types of data stolen by Raccoon Stealer 2.0 reportedly include system fingerprinting info, browser passwords, cookies, autofill data and saved credit cards, cryptocurrency wallets, files located on all disks, screenshots and installed application lists.

“We have also seen a change in how Raccoon Stealer v2 hides its intentions by using a mechanism where API names are dynamically resolved rather than being loaded statically,” Zscaler wrote.
Click to expand...

“The Authors of this malware are constantly adding new features to this family of malware. This is the second major release of the malware after the first release in 2019. This shows that the malware is likely to evolve and remain a constant threat to organizations."
Click to expand...

Zscaler: Raccoon Stealer v2: The Latest Generation of the Raccoon Family

In depth analysis & comparison with the first variant
Click to expand...

Log in or Sign up

This information-stealing trojan malware is quickly gaining popularity among cyber criminals

mood Updates Team

mood Updates Team

mood Updates Team

Minimalist Registered Member

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team