Raccoon | Threat Level: high | Type: Infostealer

Cryptographic Identifiers

SHA25684705716d00c9108b15483b01a4f69ae7a113116e44a8f6da17acdc6e51ea8c1
MD5c6f6ed1f84712740a7ee2faa2e1fff9b
File Typeexe
Size534.5 KB
First Seen2021-01-05
File Namesek750_2021.bin
TagsRaccoon, RaccoonStealer

Malware Family: Raccoon

Raccoon Stealer, MaaS infostealer'dır.

TypeInfostealer
Programming LanguageC++
Target PlatformWindows
C2 ProtocolHTTP
PurposeTarayıcı, kripto hırsızlığı
First Seen Year2019
AliasesRecordBreaker

Threat Indicators (IOC)

  • SHA256: 84705716d00c9108b15483b01a4f69ae7a113116e44a8f6da17acdc6e51ea8c1
  • MD5: c6f6ed1f84712740a7ee2faa2e1fff9b

System Cleanup Guide

  1. Disconnect the system from the network immediately
  2. Yeni bir cihazdan banka hesabı, sosyal medya ve e-posta şifrelerini değiştirin
  3. Move crypto wallets to a new address and abandon the old ones
  4. Start a full scan with up-to-date antivirus
  5. Clear saved browser passwords and enable 2FA
  6. Sign out of all sessions on every affected service

YARA Rule Hints

rule Raccoon_SHA256 {
    meta:
        description = "Raccoon sample: 84705716d00c9108"
        threat_level = "high"
        first_seen = "2021-01-05"
    condition:
        hash.sha256(0, filesize) == "84705716d00c9108b15483b01a4f69ae7a113116e44a8f6da17acdc6e51ea8c1"
}

Raccoon — Malware Profile

Raccoon Stealer credential hırsızı. ProtonVPN gizleme. Telegram C2 destegi. Browser/kripto cüzdan hedef.

Malware Type
Infostealer
Programming Language
C++
C2 Protocol
HTTP
Target Systems
Windows
Also Known As (AKA)
RecordBreaker

Technical Details

C++/C, HTTP/HTTPS C2, SQLite credential extraction (browser login data), browser history/autofill, kripto wallet stealer (Ethereum/Bitcoin), email client stealer, custom stealer panel (PHP), fingerprint (HWID/IP)

Capabilities & Behavior

Tarayıcı Kimlik Bilgileri
Çerez Hırsızlığı
Kripto Cüzdan Çalma
Sistem Bilgisi
Ekran Görüntüsü
FTP/SSH İstemci Şifreleri
E-posta İstemcisi Çalma
Veri Sızıntısı

IOC List (2 indicators)

IOC — Raccoon
# SHA256 84705716d00c9108b15483b01a4f69ae7a113116e44a8f6da17acdc6e51ea8c1 # MD5 c6f6ed1f84712740a7ee2faa2e1fff9b
TypeValueNote
sha256 84705716d00c9108b15483b01a4f69ae7a113116e44a8f6da17acdc6e51ea8c1
md5 c6f6ed1f84712740a7ee2faa2e1fff9b

C2 Servers (7 recorded servers for this family)

Address Type Port Protocol Status Country
arena.cc domain — HTTP active —
cacerts.digicert.com domain — HTTP active —
crl3.digicert.com domain — HTTP active —
crl.globalsign.com domain — HTTP active —
45.139.199.83 ip 443 HTTPS inactive RU
coded_stream.cc domain — HTTP inactive —
92.255.57.48 ip 80 HTTP sinkholed UA

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
raccooninfostealermalwarehighsha256analizzenginleştirilmiş