[ Tool ] Raccoon Stealer 27.03.2023

[helloketa420]

willl see

 

[Amandawale901]

thanks

 

[KongKongS]

고마워

너구리 도둑이란 무엇입니까?​

Raccoon 스틸러는 감염된 컴퓨터에서 중요한 정보를 훔치는 데 특화된 맬웨어의 예입니다. 일단 설치되면 Raccoon은 브라우저 기록, 암호, 쿠키, 신용 카드 정보 및 암호 화폐 지갑 정보를 포함한 광범위한 데이터를 수집할 수 있습니다 . 그런 다음 이 정보는 맬웨어 운영자가 제어하는 원격 서버로 전송됩니다.

---

---

Raccoon은 전 세계 조직에 대한 수많은 유명 공격에 관여했습니다. 그것의 성공은 부분적으로 샌드박스 바이패스 및 코드 난독화와 같은 고급 탐지 방지 기술을 사용하여 보안 연구원이 이를 분석하고 탐지하기 어렵게 만든 덕분입니다. 또한 악성코드는 지속적으로 진화하고 있습니다. 독립 실행형 또는 보완적인 맬웨어로 작동할 수 있으며 이 맬웨어 개발자는 아이디어를 광고하는 관련 포럼에 광범위한 메시지를 게시합니다.​

---

---

어떻게 작동합니까?​

기본 목적 외에도 Raccoon Stealer는 다운로더 역할을 할 수 있어 피해자의 시스템에 특정 파일을 다운로드하고 Raccoon에 감염된 PC의 봇넷을 사용하는 데 다재다능하게 사용할 수 있습니다. 또한 각 맬웨어 샘플은 고유하게 구축되어 보안 도구가 탐지하기 어렵습니다. 두 버전 모두 base64 인코딩을 사용하지만 버전 2에는 맬웨어 실행 파일에 하드 코딩된 암호 해독 키가 있는 RC4 암호화가 포함되어 있습니다. 또한 새 버전은 악성 코드에 불필요한 코드를 여러 개 삽입하여 리버스 엔지니어링 분석을 어렵게 만듭니다. 또한 이 악성코드는 데이터를 해독하고 저장하기 위해 초기 데이터 교환 중에 명령 및 제어 서버에서 수신하는 추가 동적 링크 라이브러리가 필요합니다.

최신 버전의 Raccoon Stealer에는 기본적으로 패키징 및 암호화 기능이 있습니다. 반대로 이전 버전에는 이러한 탐지 보호 기능이 없었습니다. 또한 새 버전에는 안티 VM 및 안티 샌드박싱 기능이 포함되어 있습니다. 그러나 이러한 조치의 구현에도 불구하고 최신 버전이 압축 해제된 형태로 대상 시스템에 도착하는 경우가 있어 샘플을 생성할 때 이러한 기능을 비활성화할 수 있음을 나타냅니다.

---

C2 통신​

Raccoon Stealer는 사전 정의된 IP 주소 목록을 사용하여 명령 및 제어 서버에 연결합니다. 그러나 이러한 IP 주소를 얻는 것은 첫 번째 버전과 두 번째 버전에서 다릅니다. Raccoon Stealer의 첫 번째 버전은 Telegram 메신저에 요청을 보내고 거기에서 C2 주소 목록을 얻었습니다. 새 버전에는 맬웨어 생성 단계에서 추가되는 하드코딩된 C2 주소 목록이 포함되어 있습니다. Raccoon Stealer가 C&C 서버에 처음 접속하면 DLL과 구성 파일을 수신합니다. 그런 다음 맬웨어는 수집된 정보를 재설정하고 bot_id 및 config_id 매개 변수와 함께 POST 요청을 보냅니다. 첫 번째 버전의 라이브러리는 두 번째 버전과 약간 다릅니다. ​

---

[스포일러]*** 숨겨진 텍스트: 인용할 수 없습니다. ***
[스포일러]​

 

[sellxilips]

Thanks a lot bro

 

[svaxname]

perfect

 

[rolexaa]

*cashout money making method

*botnet all tools with tutorial

*Botnet basic to advanced course

Please, Log in or Register to view URLs content!

 

[jmltda2023]

Thanks man good

 

[xdiety]

this is awesome thank you

 

[tomekmeili]

What is a Raccoon Stealer?​

Raccoon stealer is an example of malware that specializes in stealing sensitive information from infected computers. Once installed, Raccoon can collect a wide range of data, including browser history, passwords, cookies, credit card information, and cryptocurrency wallet information. This information is then sent to a remote server controlled by the malware operators.

---

---

Raccoon has been involved in numerous high-profile attacks on organizations worldwide. Its success is partly due to its use of advanced anti-detection techniques, such as sandbox bypass and code obfuscation, making it difficult for security researchers to analyze and detect it. In addition, malware is constantly evolving. It can work as standalone or complementary malware, and developers of this malware publish extensive messages on relevant forums where they advertise their brainchild.​

---

---

How does it work?​

In addition to its primary purpose, Raccoon Stealer can act as a downloader, making it versatile for downloading specific files to a victim’s system and using a botnet of Raccoon-infected PCs. Furthermore, each malware sample is uniquely built, making it difficult for security tools to detect. Although both versions use base64 encoding, version 2 includes RC4 encryption with a hard-coded decryption key in the malware executable. The new version also inserts several unnecessary codes into the malware code, making reverse-engineering analysis difficult. In addition, the malware requires additional dynamic link libraries, which it receives from the command and control server during the initial data exchange to decrypt and save data.

The latest version of Raccoon Stealer has a packaging and encryption feature by default. In contrast, the previous version did not have these detection protections. In addition, the new version includes anti-VM and anti-sandboxing features. However, despite the implementation of these measures, there were cases where the latest version arrived on target systems in unpacked form, indicating that it is possible to disable these features when generating samples.

---

C2 communication​

Raccoon Stealer uses a predefined list of IP addresses to connect to its command and control server. However, obtaining these IP addresses was different in the first version than in the second: the first version of Raccoon Stealer sent a request to the Telegram messenger and got a list of C2 addresses from there. The new version contains a list of hardcoded C2 addresses, which is added at the stage of malware generation. When Raccoon Stealer first contacts the command and control server, it receives DLLs and configuration files. The malware then resets the collected information and sends a POST request with the parameters bot_id and config_id. The libraries of the first version are slightly different from the second. ​

---

Spoiler

*** Hidden text: cannot be quoted. ***

thanks

 

[mehrdadajbb]

thankss bro look

 

[Queda de Faráo]

What is a Raccoon Stealer?​

Raccoon stealer is an example of malware that specializes in stealing sensitive information from infected computers. Once installed, Raccoon can collect a wide range of data, including browser history, passwords, cookies, credit card information, and cryptocurrency wallet information. This information is then sent to a remote server controlled by the malware operators.

---

---

Raccoon has been involved in numerous high-profile attacks on organizations worldwide. Its success is partly due to its use of advanced anti-detection techniques, such as sandbox bypass and code obfuscation, making it difficult for security researchers to analyze and detect it. In addition, malware is constantly evolving. It can work as standalone or complementary malware, and developers of this malware publish extensive messages on relevant forums where they advertise their brainchild.​

---

---

How does it work?​

In addition to its primary purpose, Raccoon Stealer can act as a downloader, making it versatile for downloading specific files to a victim’s system and using a botnet of Raccoon-infected PCs. Furthermore, each malware sample is uniquely built, making it difficult for security tools to detect. Although both versions use base64 encoding, version 2 includes RC4 encryption with a hard-coded decryption key in the malware executable. The new version also inserts several unnecessary codes into the malware code, making reverse-engineering analysis difficult. In addition, the malware requires additional dynamic link libraries, which it receives from the command and control server during the initial data exchange to decrypt and save data.

The latest version of Raccoon Stealer has a packaging and encryption feature by default. In contrast, the previous version did not have these detection protections. In addition, the new version includes anti-VM and anti-sandboxing features. However, despite the implementation of these measures, there were cases where the latest version arrived on target systems in unpacked form, indicating that it is possible to disable these features when generating samples.

---

C2 communication​

Raccoon Stealer uses a predefined list of IP addresses to connect to its command and control server. However, obtaining these IP addresses was different in the first version than in the second: the first version of Raccoon Stealer sent a request to the Telegram messenger and got a list of C2 addresses from there. The new version contains a list of hardcoded C2 addresses, which is added at the stage of malware generation. When Raccoon Stealer first contacts the command and control server, it receives DLLs and configuration files. The malware then resets the collected information and sends a POST request with the parameters bot_id and config_id. The libraries of the first version are slightly different from the second. ​

---

Spoiler

*** Hidden text: cannot be quoted. ***

thx for share love u

 

[mehrdadajbb]

thank you bro

 

[SaceGold28]

What is a Raccoon Stealer?​

Raccoon stealer is an example of malware that specializes in stealing sensitive information from infected computers. Once installed, Raccoon can collect a wide range of data, including browser history, passwords, cookies, credit card information, and cryptocurrency wallet information. This information is then sent to a remote server controlled by the malware operators.

---

---

Raccoon has been involved in numerous high-profile attacks on organizations worldwide. Its success is partly due to its use of advanced anti-detection techniques, such as sandbox bypass and code obfuscation, making it difficult for security researchers to analyze and detect it. In addition, malware is constantly evolving. It can work as standalone or complementary malware, and developers of this malware publish extensive messages on relevant forums where they advertise their brainchild.​

---

---

How does it work?​

In addition to its primary purpose, Raccoon Stealer can act as a downloader, making it versatile for downloading specific files to a victim’s system and using a botnet of Raccoon-infected PCs. Furthermore, each malware sample is uniquely built, making it difficult for security tools to detect. Although both versions use base64 encoding, version 2 includes RC4 encryption with a hard-coded decryption key in the malware executable. The new version also inserts several unnecessary codes into the malware code, making reverse-engineering analysis difficult. In addition, the malware requires additional dynamic link libraries, which it receives from the command and control server during the initial data exchange to decrypt and save data.

The latest version of Raccoon Stealer has a packaging and encryption feature by default. In contrast, the previous version did not have these detection protections. In addition, the new version includes anti-VM and anti-sandboxing features. However, despite the implementation of these measures, there were cases where the latest version arrived on target systems in unpacked form, indicating that it is possible to disable these features when generating samples.

---

C2 communication​

Raccoon Stealer uses a predefined list of IP addresses to connect to its command and control server. However, obtaining these IP addresses was different in the first version than in the second: the first version of Raccoon Stealer sent a request to the Telegram messenger and got a list of C2 addresses from there. The new version contains a list of hardcoded C2 addresses, which is added at the stage of malware generation. When Raccoon Stealer first contacts the command and control server, it receives DLLs and configuration files. The malware then resets the collected information and sends a POST request with the parameters bot_id and config_id. The libraries of the first version are slightly different from the second. ​

---

Spoiler

*** Hidden text: cannot be quoted. ***

lets check it oiut and see

 

[kingkk321]

I hope is it good

 

[m9wadDz]

Not working

 

[mohammedmd5]

What is a Raccoon Stealer?​

Raccoon stealer is an example of malware that specializes in stealing sensitive information from infected computers. Once installed, Raccoon can collect a wide range of data, including browser history, passwords, cookies, credit card information, and cryptocurrency wallet information. This information is then sent to a remote server controlled by the malware operators.

---

---

Raccoon has been involved in numerous high-profile attacks on organizations worldwide. Its success is partly due to its use of advanced anti-detection techniques, such as sandbox bypass and code obfuscation, making it difficult for security researchers to analyze and detect it. In addition, malware is constantly evolving. It can work as standalone or complementary malware, and developers of this malware publish extensive messages on relevant forums where they advertise their brainchild.​

---

---

How does it work?​

In addition to its primary purpose, Raccoon Stealer can act as a downloader, making it versatile for downloading specific files to a victim’s system and using a botnet of Raccoon-infected PCs. Furthermore, each malware sample is uniquely built, making it difficult for security tools to detect. Although both versions use base64 encoding, version 2 includes RC4 encryption with a hard-coded decryption key in the malware executable. The new version also inserts several unnecessary codes into the malware code, making reverse-engineering analysis difficult. In addition, the malware requires additional dynamic link libraries, which it receives from the command and control server during the initial data exchange to decrypt and save data.

The latest version of Raccoon Stealer has a packaging and encryption feature by default. In contrast, the previous version did not have these detection protections. In addition, the new version includes anti-VM and anti-sandboxing features. However, despite the implementation of these measures, there were cases where the latest version arrived on target systems in unpacked form, indicating that it is possible to disable these features when generating samples.

---

C2 communication​

Raccoon Stealer uses a predefined list of IP addresses to connect to its command and control server. However, obtaining these IP addresses was different in the first version than in the second: the first version of Raccoon Stealer sent a request to the Telegram messenger and got a list of C2 addresses from there. The new version contains a list of hardcoded C2 addresses, which is added at the stage of malware generation. When Raccoon Stealer first contacts the command and control server, it receives DLLs and configuration files. The malware then resets the collected information and sends a POST request with the parameters bot_id and config_id. The libraries of the first version are slightly different from the second. ​

---

Spoiler

*** Hidden text: cannot be quoted. ***

thanks broo

 

[mehrdadajbb]

thanks bro
oh my god

 

[xannyzee123]

What is a Raccoon Stealer?​

Raccoon stealer is an example of malware that specializes in stealing sensitive information from infected computers. Once installed, Raccoon can collect a wide range of data, including browser history, passwords, cookies, credit card information, and cryptocurrency wallet information. This information is then sent to a remote server controlled by the malware operators.

---

---

Raccoon has been involved in numerous high-profile attacks on organizations worldwide. Its success is partly due to its use of advanced anti-detection techniques, such as sandbox bypass and code obfuscation, making it difficult for security researchers to analyze and detect it. In addition, malware is constantly evolving. It can work as standalone or complementary malware, and developers of this malware publish extensive messages on relevant forums where they advertise their brainchild.​

---

---

How does it work?​

In addition to its primary purpose, Raccoon Stealer can act as a downloader, making it versatile for downloading specific files to a victim’s system and using a botnet of Raccoon-infected PCs. Furthermore, each malware sample is uniquely built, making it difficult for security tools to detect. Although both versions use base64 encoding, version 2 includes RC4 encryption with a hard-coded decryption key in the malware executable. The new version also inserts several unnecessary codes into the malware code, making reverse-engineering analysis difficult. In addition, the malware requires additional dynamic link libraries, which it receives from the command and control server during the initial data exchange to decrypt and save data.

The latest version of Raccoon Stealer has a packaging and encryption feature by default. In contrast, the previous version did not have these detection protections. In addition, the new version includes anti-VM and anti-sandboxing features. However, despite the implementation of these measures, there were cases where the latest version arrived on target systems in unpacked form, indicating that it is possible to disable these features when generating samples.

---

C2 communication​

Raccoon Stealer uses a predefined list of IP addresses to connect to its command and control server. However, obtaining these IP addresses was different in the first version than in the second: the first version of Raccoon Stealer sent a request to the Telegram messenger and got a list of C2 addresses from there. The new version contains a list of hardcoded C2 addresses, which is added at the stage of malware generation. When Raccoon Stealer first contacts the command and control server, it receives DLLs and configuration files. The malware then resets the collected information and sends a POST request with the parameters bot_id and config_id. The libraries of the first version are slightly different from the second. ​

---

Spoiler

*** Hidden text: cannot be quoted. ***

drcrypter.ru

 

[ghost88]

Thanks bro

 

[mehrdadajbb]

hope it is good