This information-stealing trojan malware is quickly gaining popularity among cyber criminals

mood · Oct 24, 2019

This easy-to-use information-stealing trojan malware is quickly gaining popularity among cyber criminals
Racoon Stealer isn't sophisticated, but it has stolen credit card information, passwords and more from hundreds of thousands of victims
October 24, 2019
https://www.zdnet.com/article/this-...kly-gaining-popularity-among-cyber-criminals/

A new kind of easy to use trojan malware is gaining popularity among cyber criminals, providing them with simple means of stealing credit card data, passwords and cryptocurrency -- and it has already infected hundreds of thousands of Windows users around the world.
Raccoon Stealer first appeared in April this year and has quickly risen to become one of the most talked-about malware services in underground forums.

Researchers at Cybereason have been monitoring Raccoon since it first emerged, and note that while not sophisticated, it is aggressively marketed to potential criminal users, providing them with an easy-to-use back end, along with bulletproof hosting and 24/7 support -- all for $200 a month.
Raccoon's flexible nature allows it to be delivered to victims in a number of ways, but it's most often distributed via exploit kits, phishing and compromised software downloads.
Click to expand...

Cybereason: Hunting Raccoon: The New Masked Bandit on the Block

mood · Nov 22, 2019

Raccoon Stealer Malware Scurries Past Microsoft Messaging Gateways
November 22, 2019
https://threatpost.com/raccoon-stealer-malware-scurries-past-microsoft-messaging-gateways/150545/

Criminals behind malware dubbed Raccoon Stealer have adopted a simple and effective technique to circumvent Microsoft and Symantec anti-spam messaging gateways.

According to a Cofense report posted Thursday, the malware is delivered inside an .IMG file hosted on a hacker-controlled Dropbox account.

“Using the familiar theme of a wire transfer—closely akin to those often seen in business email compromise scams—the threat actors look to trick users into opening the Dropbox URL and downloading the malicious file,” wrote Cofense authors Max Gannon and Alan Rainer.
What makes the Raccoon Stealer interesting to researchers is that it is new, easy-to-use and under active development by the hackers behind it. Cofense said the malware was first spotted in April of 2019 and since then has been leveraged in several different campaigns.
Click to expand...

Because of the malware’s flexibility to deliver a variety of payloads the Raccoon Stealer is gaining traction in underground markets, said researchers.

“Given the variety of delivery options, Raccoon Stealer could be a problem for organizations that focus too much on one infection vector,” Cofense researchers said.
Click to expand...

Cofense: Raccoon Stealer Found Rummaging Past Symantec and Microsoft Gateways

mood · Feb 24, 2020

Raccoon Malware Steals Your Data From Nearly 60 Apps
February 24, 2020
https://www.bleepingcomputer.com/news/security/racoon-malware-steals-your-data-from-nearly-60-apps/

An infostealing malware that is relatively new on cybercriminal forums can extract sensitive data from about 60 applications on a targeted computer.
Unsophisticated yet good enough
Also known as Legion, Mohazo, and Racealer, the malware was initially promoted only on Russian-speaking forums but it soon made its entrance in the English-speaking space. The malware was first seen in the wild April 2019 and it is distributed under the MaaS (malware-as-a-service) model for $75/week or $200/month.

An analysis from CyberArk found that it is written in C++ and is far from being a complex tool. However, it can steal sensitive and confidential information from almost 60 programs (browsers, cryptocurrency wallets, email and FTP clients).
Additional capabilities in the malware include collecting system details (OS version and architecture, language, hardware info, enumerate installed apps).

"After fulfilling all his stealing capabilities, it gathers all the files that it wrote to temp folder into one zip file named Log.zip. Now all it has to do is send the zip file back to the C&C server and delete its trace" - CyberArk
Click to expand...

CyberArk: Raccoon: The Story of a Typical Infostealer

Minimalist · Mar 10, 2020

Malware Spread as Nude Extortion Pics of Friend's Girlfriend

Attackers have recently warped sextortion scams into baits used to infect their targets with Raccoon information stealer malware designed to help steal credentials, credit card information, desktop cryptocurrency wallets, and more.
Click to expand...

https://www.bleepingcomputer.com/ne...as-nude-extortion-pics-of-friends-girlfriend/

mood · Apr 1, 2020 at 5:42 PM

New Raccoon Stealer uses Google Cloud Services to evade detection
April 1, 2020
https://securityaffairs.co/wordpress/100869/malware/raccoon-abuses-google-services.html

Racoon malware (aka Legion, Mohazo, and Racealer) is an info-stealer that recently appeared in the threat landscape that is advertised in hacking forums.
The malware is cheap compared to similar threats, it is able to steal sensitive data from about 60 applications, including (browsers, cryptocurrency wallets, email and FTP clients).

“Once the Raccoon malware infects a machine, it connects to a Google Drive URL to decrypt the actual C&C server. The format of the URL is hxxp://{IP}/gate/log.php, which logs the computer configuration information. Then, it will receive a JSON-formatted file containing the location dependencies. Next, it will connect to URL hxxp://{IP}/file_handler/file.php for data exfiltration.” reads the analysis published by Trend Micro.
The malware was distributed also via malspam emails, the messages used an attachment that drops the Raccoon malware (TrojanSpy.Win32.RACEALER.M) and their content claimed that the recipient’s friend had their email hacked. The messages attempt to blackmail the recipient demanding money in exchange for the stolen sensitive information they claim to have stolen.
Click to expand...

Since April 2019, experts already detected more than 100,000 raccoon related events, with a peak in detections in July 2019. Experts identified over 3,000 unique binary samples of the Raccoon “Racestealer” stealer since the second quarter of 2019, they pointed out that operators behind the MaaS continue to release new versions of the malware.

“The current activity of the Raccoon malware seems to indicate that its development and use by threat actors will continue. The next best move for its creators would likely be to improve and fix some of its bugs, and then add new techniques to its relatively basic repertoire.” concludes Trend Micro.
Click to expand...

Trend Micro: Raccoon Stealer’s Abuse of Google Cloud Services and Multiple Delivery Techniques

Raccoon emerged as Malware as a Service (MaaS) last April 2019. Despite its simplicity, Raccoon became popular among cybercriminals and was mentioned as a notable emerging malware in underground forums in a malware popularity report.

It can arrive on a system through different delivery techniques such as exploit kits, phishing, and bundled with other malware. In this blog entry we investigate campaigns that used the exploit kits Fallout and Rig, where we also observed its use of Google Drive as part of its evasion tactics.
Click to expand...

Log in or Sign up

This information-stealing trojan malware is quickly gaining popularity among cyber criminals

mood Updates Team

mood Updates Team

mood Updates Team

Minimalist Registered Member

mood Updates Team

Wiper Malware Called “Coronavirus” Spreads Among Windows Victims

New AZORult Campaign Abuses Popular VPN Service to Steal Cryptocurrency

LokiBot trojan malware campaign comes disguised as a popular game launcher

Criminals are using ‘Frankenstein identities’ to steal from banks and credit unions

This trojan malware is being used to steal passwords and spread ransomware

Log in or Sign up

This information-stealing trojan malware is quickly gaining popularity among cyber criminals

mood Updates Team

mood Updates Team

mood Updates Team

Minimalist Registered Member

mood Updates Team

Wiper Malware Called “Coronavirus” Spreads Among Windows Victims

New AZORult Campaign Abuses Popular VPN Service to Steal Cryptocurrency

LokiBot trojan malware campaign comes disguised as a popular game launcher

Criminals are using ‘Frankenstein identities’ to steal from banks and credit unions

This trojan malware is being used to steal passwords and spread ransomware

Useful Searches