Raccoon Stealer

Description

Raccoon Stealer is an information stealer that its operators reportedly sold for $75 a week or $200 a month. It gathers personal information including passwords, browser cookies and autofill data, and cryptocurrency wallet details, and it records system information such as IP addresses and geolocation data.

Stats

First seen: May 2022
Last seen: September 2026

Also known as

RaccoonRaccoonStealerRaccoonstealer

MITRE ATT&CK techniques

24 techniques across 7 tactics.

TA0001 Initial Access

T1195Supply Chain Compromise

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
- T1027.007Dynamic API Resolution
T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information

TA0006 Credential Access

T1539Steal Web Session Cookie
T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1012Query Registry
T1033System Owner/User Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1087Account Discovery
- T1087.001Local Account
T1124System Time Discovery
T1518Software Discovery
T1614System Location Discovery

TA0009 Collection

T1005Data from Local System
T1113Screen Capture
T1119Automated Collection
T1213Data from Information Repositories
T1560Archive Collected Data

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer

TA0010 Exfiltration

T1020Automated Exfiltration
T1041Exfiltration Over C2 Channel

Associated groups

G1015Scattered Spider

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Spyware.Raccoonstealer	ATP Sandbox Adv. Heuristics
Gen:Variant.Barys.Raccoon.330319	AV
Gen:Variant.Doina.Raccoon.38492	AV
Win32.Infostealer.Raccoon	ATP Sandbox Adv. Heuristics
Win32.Spyware.Raccoon	ATP Sandbox Adv. Heuristics
Win32.Spyware.Raccoonstealer	ATP Sandbox Adv. Heuristics
Win32.Trojan.Raccoon	ATP Sandbox Adv. Heuristics
Win32.Trojan.Raccoonstealer	ATP Sandbox Adv. Heuristics
Win32.Trojan.RaccoonStealer	ATP Sandbox Adv. Heuristics
Win64.Spyware.Raccoonstealer	ATP Sandbox Adv. Heuristics
Win64.Trojan.Raccoon	ATP Sandbox Adv. Heuristics
Win64.Trojan.RaccoonStealer	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Trojan.Raccoon data exfiltration attempt	IPS-SWG
MALWARE-CNC Win.Trojan.Raccoon variant RC4 encrypted outbound request attempt	IPS-SWG
MALWARE-OTHER Win.Trojan.Raccoon download attempt	IPS-SWG

Related blogs

Threat Labs News Roundup: March 2023

April 10, 20234 min read