What is a Raccoon Stealer?
Raccoon stealer is an example of malware that specializes in stealing sensitive information from infected computers. Once installed, Raccoon can collect a wide range of data, including browser history, passwords, cookies, credit card information, and cryptocurrency wallet information. This information is then sent to a remote server controlled by the malware operators.
Raccoon has been involved in numerous high-profile attacks on organizations worldwide. Its success is partly due to its use of advanced anti-detection techniques, such as sandbox bypass and code obfuscation, making it difficult for security researchers to analyze and detect it. In addition, malware is constantly evolving. It can work as standalone or complementary malware, and developers of this malware publish extensive messages on relevant forums where they advertise their brainchild.
How does it work?
In addition to its primary purpose, Raccoon Stealer can act as a downloader, making it versatile for downloading specific files to a victim’s system and using a botnet of Raccoon-infected PCs. Furthermore, each malware sample is uniquely built, making it difficult for security tools to detect. Although both versions use base64 encoding, version 2 includes RC4 encryption with a hard-coded decryption key in the malware executable. The new version also inserts several unnecessary codes into the malware code, making reverse-engineering analysis difficult. In addition, the malware requires additional dynamic link libraries, which it receives from the command and control server during the initial data exchange to decrypt and save data.The latest version of Raccoon Stealer has a packaging and encryption feature by default. In contrast, the previous version did not have these detection protections. In addition, the new version includes anti-VM and anti-sandboxing features. However, despite the implementation of these measures, there were cases where the latest version arrived on target systems in unpacked form, indicating that it is possible to disable these features when generating samples.
C2 communication
Raccoon Stealer uses a predefined list of IP addresses to connect to its command and control server. However, obtaining these IP addresses was different in the first version than in the second: the first version of Raccoon Stealer sent a request to the Telegram messenger and got a list of C2 addresses from there. The new version contains a list of hardcoded C2 addresses, which is added at the stage of malware generation. When Raccoon Stealer first contacts the command and control server, it receives DLLs and configuration files. The malware then resets the collected information and sends a POST request with the parameters bot_id and config_id. The libraries of the first version are slightly different from the second.
