Raccoon Stealer v2 marks a notable revival of the information stealer brand, with early signs of life detected in 2022 as servers and administration panels surfaced. SEKOIA.IO documents a refreshed build, renewed distribution, and a plan to scale behind a redesigned backend and frontend; the article also notes a likely continuation of aggressive marketing and development. #RaccoonStealer #RaccoonStealerV2
Keypoints
- Raccoon Stealer v2 (2.0) emerged in 2022 after a shutdown of the original project, with tests of its presence on Shodan indicating active infrastructure.
- The threat group behind Raccoon Stealer advertised the new version via Telegram and Telegram-channel posts, signaling a relaunch and commercial intention.
- Analysts connected the May 17 promotional activity to broader “RecordBreaker” discussions, suggesting the same malware family may be marketed under multiple names.
- The malware remains distributed mainly through fake installers and cracked software, continuing the tactic that made the original Raccoon Stealer widely used.
- Technical analysis shows a compact 56 KB binary written in C/C++, capable of loading DLLs, collecting browser data and wallet information, and sending data to a C2 via HTTP.
- SEKOIA.IO highlights a Redux-like back-end/front-end rewrite, automated data collection (system info, cookies, wallets, screenshots), and a straightforward data exfiltration flow, with some discrepancies between advertised encryption and observed behavior.
MITRE Techniques
- [T1140] Deobfuscate/Decode Files or Information – Raccoon Stealer v2 decodes strings and the C2 configuration in the malware using RC4 and base64. ‘Raccoon Stealer v2 decodes strings and the C2 configuration in the malware using RC4 and base64.’
- [T1027] Obfuscated Files or Information – Raccoon Stealer v2 uses RC4-encrypted strings. ‘Raccoon Stealer v2 uses RC4-encrypted strings.’
- [T1539] Steal Web Session Cookie – Raccoon Stealer v2 harvests cookies from popular browsers. ‘Raccoon Stealer v2 harvests cookies from popular browsers.’
- [T1555.003] Credentials from Password Stores: Credentials from Web Browsers – Raccoon Stealer v2 collects passwords from popular browsers. ‘Raccoon Stealer v2 collects passwords from popular browsers.’
- [T1083] File and Directory Discovery – Raccoon Stealer v2 lists files and directories to grab files through all disks. ‘Raccoon Stealer v2 lists files and directories to grab files through all disks.’
- [T1057] Process Discovery – Raccoon Stealer v2 lists the current running processes on the system. ‘Raccoon Stealer v2 lists the current running processes on the system.’
- [T1012] Query Registry – Raccoon Stealer v2 queries the Windows Registry key at HKLMSOFTWAREMicrosoftCryptographyMachineGuid to retrieve the MachineGuid value. ‘Raccoon Stealer v2 queries the Windows Registry key … MachineGuid value.’
- [T1518] Software Discovery – Raccoon Stealer v2 lists all installed software for the infected machine, by querying the Windows Registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstall. ‘Raccoon Stealer v2 lists all installed software…’
- [T1082] System Information Discovery – Raccoon Stealer v2 collects OS version, host architecture, CPU information, RAM capacity and display device information. ‘Raccoon Stealer v2 collects OS version, host architecture, CPU information, RAM capacity and display device information.’
- [T1614] System Time Discovery – Raccoon Stealer v2 collects the time zone information from the system. ‘Raccoon Stealer v2 collects the time zone information from the system.’
- [T1119] Automated Collection – Raccoon Stealer v2 scans the disks and automatically collects files. ‘Raccoon Stealer v2 scans the disks and automatically collects files.’
- [T1005] Data from Local System – Raccoon Stealer v2 collects credentials of cryptocurrency wallets from the local system. ‘Raccoon Stealer v2 collects credentials of cryptocurrency wallets from the local system.’
- [T1113] Screen Capture – Raccoon Stealer v2 captures a screenshot of the victim’s desktop. ‘Raccoon Stealer v2 captures a screenshot of the victim’s desktop.’
- [T1071.001] Application Layer Protocol: Web Protocols – Raccoon Stealer v2 uses HTTP for C2 communications. ‘Raccoon Stealer v2 uses HTTP for C2 communications.’
- [T1041] Exfiltration Over C2 Channel – Raccoon Stealer v2 exfiltrates data over the C2 channel. ‘Raccoon Stealer v2 exfiltrates data over the C2 channel.’
- [T1105] Ingress Tool Transfer – Raccoon Stealer v2 downloads legitimate third-party DLLs for data collection onto compromised hosts. ‘Raccoon Stealer v2 downloads legitimate third-party DLLs for data collection onto compromised hosts.’
- [T1106] Native API – Raccoon Stealer v2 has the ability to launch files using ShellExecuteW. ‘Raccoon Stealer v2 has the ability to launch files using ShellExecuteW.’
- [T1055.001] Process Injection: DLL Injection – Raccoon Stealer v2 has the ability to load DLLs via LoadLibraryW and GetProcAddress. ‘Raccoon Stealer v2 has the ability to load DLLs via LoadLibraryW and GetProcAddress.’
- [T1407] Download New Code at Runtime – Raccoon Stealer v2 downloads its next stage from a remote host. ‘Raccoon Stealer v2 downloads its next stage from a remote host.’
Indicators of Compromise
- [IP Address] C2 servers – 136.244.65.99, 138.197.179.146
- [SHA-256] Sample hashes – 0123b26df3c79bac0a3fda79072e36c159cfd1824ae3fd4b7f9dea9bda9c7909, 022432f770bf0e7c5260100fcde2ec7c49f68716751fd7d8b9e113bf06167e03
- [Domain] C2 domain – raccoonstealer.app
- [File Name] System Info.txt – created by the malware during execution
Read more: https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/