Raccoon

Aliases: Mohazo, RaccoonStealer, Racealer, Racoon

First seen
2019-04-01 00:00:00
Malware type
credential-stealer, spyware
Family
Malware family
Last IoC activity
2026-07-22 01:55:25
Profile updated
2026-07-07 13:11:26

Context

Raccoon Stealer is a malware reportedly sold for $75 a week or $200 a month. It gathers personal information including passwords, browser cookies and autofill data, as well as cryptowallet details. Additionally, Raccoon Stealer records system information such as IP addresses and geo-location data.

Detection coverage

  • 6 YARA rules

Detection rules

  • RUSSIANPANDA_Raccoonstealer (yara-rule)
  • DITEKSHEN_MALWARE_Win_Agentracoon (yara-rule)
  • SEKOIA_Infostealer_Win_Raccoon_Str_Takemypainback (yara-rule)
  • SEKOIA_Apt_Agent_Racoon_Strings (yara-rule)
  • SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1 (yara-rule)
  • MALPEDIA_Win_Raccoon_Auto (yara-rule)

Reports & references

  • decoded.avast.io — Avast Q2 2022 Threat Report (report)
  • cloud.google.com — Unc5537 Snowflake Data Theft Extortion (report)
  • malwarebytes.com — Malvertising Campaigns Come Back In Full Swing (report)
  • CISA — Aa23 320A (report)
  • ptsecurity.com — Paas Or How Hackers Evade Antivirus Software (report)
  • go.recordedfuture.com — Cta 2022 0802 (report)
  • blogs.blackberry.com — Dot Net Stubs Sowing The Seeds Of Discord (report)
  • CISA — Aa23 320A Scattered Spider (report)
  • spamhaus.org — 2020 Q2 Spamhaus Botnet Threat Report (report)
  • riskiq.com — Magecart Medialand (report)
  • blog.sekoia.io — Privateloader The Loader Of The Prevalent Ruzki Ppi Service (report)
  • team-cymru.com — Seychelles Seychelles On The C 2 Shore (report)
  • medium.com — Gcleaner Garbage Provider Since 2019 2708E7C87A8A (report)
  • Cisco Talos — Raccoon And Amadey Install Servhelper (report)
  • ke-la.com — Information Stealers A New Landscape (report)
  • medium.com — W1 Feb En Story Of The Week Stealers On The Darkweb 49945A31601D (report)
  • blog.checkpoint.com — A German Car Attack On German Vehicle Businesses (report)
  • bleepingcomputer.com — New Meta Information Stealer Distributed In Malspam Campaign (report)
  • asec.ahnlab.com — 35981 (report)
  • prodaft.com — Rig Tlp Clear 1 (report)
  • spamhaus.com — Botnet Update Q1 2021 (report)
  • medium.com — Updates From The Maas New Threats Delivered Through Nullmixer D45Defc260D1 (report)
  • secureworks.com — The Growing Threat From Infostealers (report)
  • decoded.avast.io — Zloader The Silent Night (report)
  • blog.sekoia.io — Traffers A Deep Dive Into The Information Stealer Ecosystem (report)

External references