Raccoon Stealer

First seen

2019-01-01 00:00:00

Malware type

credential-stealer

Family

Malware family

Operating systems

windows

Related IoCs

970 (970 malicious)

Last IoC activity

2026-10-17 16:17:07

Profile updated

2026-07-07 15:17:12

Targeted industries: financial-services retail-and-hospitality technology-and-telecommunications

Context

Raccoon Stealer is an information stealer malware family active since at least 2019 as a malware-as-a-service offering sold in underground forums. Raccoon Stealer has experienced two periods of activity across two variants, from 2019 to March 2022, then resurfacing in a revised version in June 2022.

Recent IoC activity

970 malicious indicators in Maltiverse are attributed to Raccoon Stealer (S1148). The 20 most recently updated:

Detection coverage

• 1 YARA rules
• 292 Sigma rules

Malware & tools used

• System Owner/User Discovery (attack-pattern)
• Web Protocols (attack-pattern)
• Data from Local System (attack-pattern)
• System Time Discovery (attack-pattern)
• Encrypted/Encoded File (attack-pattern)
• Ingress Tool Transfer (attack-pattern)
• Automated Exfiltration (attack-pattern)
• Data from Information Repositories (attack-pattern)
• Credentials from Web Browsers (attack-pattern)
• Archive Collected Data (attack-pattern)
• Dynamic API Resolution (attack-pattern)
• Supply Chain Compromise (attack-pattern)
• System Location Discovery (attack-pattern)
• Automated Collection (attack-pattern)
• Screen Capture (attack-pattern)
• Exfiltration Over C2 Channel (attack-pattern)
• File Deletion (attack-pattern)
• Query Registry (attack-pattern)
• Software Discovery (attack-pattern)
• Local Account (attack-pattern)
• Steal Web Session Cookie (attack-pattern)
• Deobfuscate/Decode Files or Information (attack-pattern)
• System Information Discovery (attack-pattern)
• File and Directory Discovery (attack-pattern)

Used by threat actors

• Scattered Spider (threat-actor)

Detection rules

• RUSSIANPANDA_Raccoonstealer (yara-rule)

Reports & references

• medium.com — Raccoon Stealer Is Back With A New Version 5F436E04B20D (report)
• blog.sekoia.io — Raccoon Stealer V2 Part 1 The Return Of The Dead (report)
• MITRE ATT&CK — S1148 (report)

External references

• mitre-attack — S1148
• Sekoia Raccoon1 2022
• S2W Racoon 2022
• misp-galaxy
• misp-galaxy
• misp-galaxy