Raccoon
Aliases: Mohazo, RaccoonStealer, Racealer, Racoon
- First seen
- 2019-04-01 00:00:00
- Malware type
- credential-stealer, spyware
- Family
- Malware family
- Related IoCs
- 214 (150 malicious)
- Last IoC activity
- 2026-10-18 01:56:50
- Profile updated
- 2026-07-07 13:11:26
Context
Raccoon Stealer is a malware reportedly sold for $75 a week or $200 a month. It gathers personal information including passwords, browser cookies and autofill data, as well as cryptowallet details. Additionally, Raccoon Stealer records system information such as IP addresses and geo-location data.
Detection coverage
- 6 YARA rules
Detection rules
- SEKOIA_Apt_Agent_Racoon_Strings (yara-rule)
- SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1 (yara-rule)
- SEKOIA_Infostealer_Win_Raccoon_Str_Takemypainback (yara-rule)
- DITEKSHEN_MALWARE_Win_Agentracoon (yara-rule)
- RUSSIANPANDA_Raccoonstealer (yara-rule)
- MALPEDIA_Win_Raccoon_Auto (yara-rule)
Reports & references
- CISA — Aa23 320A (report)
- go.recordedfuture.com — Cta 2022 0802 (report)
- ptsecurity.com — Paas Or How Hackers Evade Antivirus Software (report)
- decoded.avast.io — Avast Q2 2022 Threat Report (report)
- cloud.google.com — Unc5537 Snowflake Data Theft Extortion (report)
- malwarebytes.com — Malvertising Campaigns Come Back In Full Swing (report)
- blogs.blackberry.com — Dot Net Stubs Sowing The Seeds Of Discord (report)
- CISA — Aa23 320A Scattered Spider (report)
- spamhaus.com — Botnet Update Q1 2021 (report)
- medium.com — Updates From The Maas New Threats Delivered Through Nullmixer D45Defc260D1 (report)
- secureworks.com — The Growing Threat From Infostealers (report)
- decoded.avast.io — Zloader The Silent Night (report)
- blog.sekoia.io — Traffers A Deep Dive Into The Information Stealer Ecosystem (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Raccoon (report)
- cyberint.com — Raccoon Stealer (report)
- labs.k7computing.com — Raccoon Back With New Claws (report)
- lp.cyberark.com — Cyberark Labs Racoon Malware Wp (report)
- cloudsek.com — Recordbreaker The Resurgence Of Raccoon (report)
- d01a.github.io — Raccoon Stealer (report)
- webcache.googleusercontent.com — Search (report)
- news.sophos.com — Trash Panda As A Service Raccoon Stealer Steals Cookies Cryptocoins And More (report)
- secfreaks.gr — In Depth Analysis Of An Infostealer Raccoon (report)
- github.com — Raccon%20Stealer%20Technical%20Analysis%20Report (report)
- youtube.com — Watch (report)
- justice.gov — Newly Unsealed Indictment Charges Ukrainian National International Cybercrime Operation (report)