Raccoon Stealer Updates Show Focus on Protecting Payloads

Raccoon Stealer Updates Show Focus on Protecting Payloads

Raccoon Stealer is an information stealer that emerged in April 2019. Like most stealers, it is capable of stealing stored auto-fill data, cookies, credentials, credit card data and history from Chromium-based browsers such as Google Chrome and Microsoft Edge. Targeted theft of several cryptocurrency wallets is also supported. Updates often add support for new cryptocurrencies, though it can also be configured to locate any wallet.dat file as well.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Review network logs for potential signs of compromise and data egress.
• Enforce administrative or application control restrictions to prevent unauthorized installation of software or media

Details

Raccoon Stealer is an infostealer (information stealer) type of malware first advertised on various underground forums in April 2019 by an actor going by the handle "raccoonstealer." Its focus is on being small, efficient, and simple enough for anyone to use. To accomplish this, Raccoon Stealer was created as a service offering, complete with a cloud control panel allowing would-be subscribers to configure everything in "just a few clicks." At just $75 per week or $200 per month, Raccoon Stealer is fairly cheap for actors as well.

Figure 1. Original advertisement for Raccoon Stealer (in Russian) in 2019
Source: ZeroFox Threat Research

Multiple updates have happened since the start of the quarter, most notable among them being the addition of new "crypters." A crypter's purpose is to obfuscate a given binary by doing this such as inserting junk code, breaking up the flow of code without changing the original functionality or encrypting sections of code so they cannot be detected by static signatures. Other updates include support for stealing several new cryptocurrency wallets and adding Discord to the list of targeted applications.

Figure 2. A Raccoon Stealer update adds support for a new crypter, “NinjaCrypt”
Source: ZeroFox Threat Research

On August 4, 2021, the actor raccoonstealer announced that they were looking to cooperate with other crypter developers and had completed an "automatic system for issuing a encrypted build.'' This was seemingly in response to subscriber feedback.

Figure 3. Actor raccoonstealer announces they seeking out new crypter projects
Source: ZeroFox Threat Research

An analysis by Cyberint of the JavaScript for Raccoon Stealer's control panel found messages to be displayed to subscribers, instructing them to "crypt" their generated builds. The actor racoonstealer has also been observed reminding others that "Usage without crypt is prohibited."

Figure 4. Actor raccoonstealer reminds a subscriber that crypters must be used against deployed binaries
Source: ZeroFox Threat Research

The recently introduced "Raccoon Clipper" was also updated at the end of July, adding support for the Monero and ZCash cryptocurrencies. Racoon Clipper is an add-on developed separately from the main stealer and works as the name may suggest: monitoring the Windows clipboard. Once it detects a supported cryptocurrency address, it will replace it with one configured by the subscriber in hopes that unsuspecting victims will continue the transaction, unaware that the target address has been changed.

Figure 5. Update notes for Raccoon Clipper, a paid add-on to Raccoon Stealer
Source: ZeroFox Threat Research

Conclusion

The group behind Raccoon Stealer has established themselves as a capable group in the two years since they debuted, providing new features at a regular pace and earning a mostly positive reputation within the community. They've also shown a willingness to add features based on the demands of their subscribers as demonstrated by the recently created API for automatically generating encrypted builds. With the development of a new API for automatically providing obfuscated or "crypted" builds, new targeted applications and support for more cryptocurrency wallets, this quarter has been an active one for Raccoon Stealer.