Racoon

                                                                                         Racoon InfoStealer

Blog Credit: Trupti Thakur

Image Courtesy: Google

In a recent cyberattack, eight Central government entities, including central paramilitary forces and the Income Tax department, were targeted by the Raccoon Stealer malware. The attack was brought to the attention of the affected agencies by the National Technical Research Organization (NTRO), a specialized intelligence agency under the National Security Advisor.

Raccoon Stealer is a classic example of information-stealing malware, which cybercriminals typically use to gain possession of sensitive data saved in users’ browsers and cryptocurrency wallets. In the case of browsers, targeted data typically includes cookies, saved login details, and saved credit card details.

What kind of malware is Raccoon Stealer?

Raccoon Stealer (also known as Legion, Mohazo, and Racealer) is high-risk trojan-type application that stealthily infiltrates the system and collects personal information. Having this trojan installed on your computer might lead to various issues. Furthermore, cyber criminals offer this trojan’s services within hacker forums.

Therefore, any aspiring cyber criminal can purchase a subscription and generate revenue by misusing stolen data.

More about the Raccoon Stealer

As mentioned above, Raccoon Stealer gathers personal information. This includes passwords, browser cookies and autofill data, and cryptowallet details. Additionally, Raccoon Stealer records system information such as Internet Protocol (IP) addresses and geo-location. The data can be misused in various ways.

Cyber criminals might use it to transfer users’ funds in cryptowallets and other accounts (e.g., PayPal, bank accounts, etc.). Victims could, therefore, lose their savings. Additionally, hijacked accounts (e.g., Facebook, emails, etc.) can be misused to borrow money.

Thus, victims might accrue significant debt. In addition, cyber criminals often use stolen contacts to proliferate malware by spamming malicious links/files to all contacts. Note that Raccoon Stealer developers aim to generate revenue by selling collected data, rather than misusing it themselves.

I.e., they offer a service that allows “subscribers” to access stolen data. Raccoon Stealer developers provide an admin panel, which allows subscribers to view and download chosen information (logs).

Raccoon Stealer is not the first (and certainly, not the last) malware infection that is sold on hacker forums, however, it is rather unique, since the buyer does not need to proliferate any malware. Raccoon Stealer developers are responsible for distribution, whilst the subscriber gains access only to the stored data and not the malicious executable (the malware programs).

In other more common cases, malware developers sell malicious executables, which buyers must then proliferate. Therefore, Raccoon Stealer gains a significant advantage, since this is a much more convenient for subscribers who are looking for generic personal data.

Raccoon Stealer developers offer a weekly/monthly subscription for a cost of $75/$200. This cost is low when considering the revenue that can potentially be generated. It is also worth mentioning that Raccoon Stealer can be used as a malware injection tool.

It is capable of downloading and executing additional files, which means that crooks might use it to infect systems with additional malware, such as ransomware or cryptominers. Fortunately, most anti-virus/anti-spyware suites are capable of detecting and eliminating Raccoon Stealer malware.

Therefore, if you suspect Raccoon Stealer’s presence on your system, immediately scan the system with this software and eliminate all detected threats. Also change the passwords of all accounts. Bear in mind that using an identical password for multiple accounts is very unsafe.

Furthermore, we strongly advise you to use combinations of random uppercase/lowercase letters, digits and (if possible) symbols, since existing words and personal information (e.g., name, surname, birth date) are very easy to crack.

Threat Summary:
Name	Raccoon Stealer trojan
Threat Type	Trojan, Password-stealing virus, Banking malware, Spyware
Detection Names (2.exe)	Avast (Win32:Trojan-gen), BitDefender (Gen:Heur.Titirez.1.F), ESET-NOD32 (Win32/Spy.Agent.PQZ), Kaspersky (Trojan-Spy.MSIL.Stealer.aik), Full List (VirusTotal)
Malicious Process Name(s)	2.exe (the name may vary).
Symptoms	Trojans are designed to stealthily infiltrate the victim’s computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine.
Distribution methods	Infected email attachments, malicious online advertisements, social engineering, software ‘cracks’.
Damage	Stolen banking information, passwords, identity theft, victim’s computer added to a botnet.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner.

Similarities with other information-stealing trojans

The internet is full of data-tracking trojans. For example, Banload, Bolik, Tofsee, Vidar, and many others. In most cases, however, developers of these infections do not provide stolen-data-access services as is the case with Raccoon Stealer’s developers.

Typically, cyber criminals misuse recorded information and generate revenue by selling malicious executables so that buyers can infect other people’s computers and gather data directly, without involving third parties.

In any case, the presence of such infections can lead to identical issues: significant financial loss, serious privacy issues, and identity theft. Eliminate all data-tracking trojans immediately.

How did Raccoon Stealer infiltrate my computer?

A known distribution tool used to spread Raccoon Stealer is Rig Exploit Kit (RigEK), which injects systems with the Smoke Loader trojan. This, in turn, downloads and injects Raccoon Stealer. There are, however, number of other tools/methods used to spread these trojans.

The list includes third party software download sources, spam email campaigns, fake software updaters and cracks, and other trojans (leading to chain infections). Cyber criminals use unofficial download sources (free file hosting websites, peer-to-peer [P2P] networks, freeware download websites, etc.) to proliferate malware by presenting it as legitimate software.

Users are tricked into manual download/installation of malware. Spam campaigns are also used in a similar manner. Cyber criminals send hundreds of thousands of identical emails containing malicious attachments (files/links) and deceptive messages.

The messages typically present the attachments as ‘important documents’ (bills, invoices, receipts or similar) in attempts to give the impression of legitimacy and trick users into opening them. The idea behind software cracks is to activate paid software free of charge, however, many of these tools are fake.

Rather than allowing access paid features, they simply inject malware into the system. Fake updaters are very similar. Rather than updating installed applications, these tools infect computers by exploiting outdated software bugs/flaws or simply downloading and installing malware rather than the updates.

Finally, trojans cause “chain infections”. These malicious apps stealthily infiltrate computers and, while running in the background, download and install additional malware (usually, high-risk infections, such as other trojans). In summary, the main reasons for computer infections are lack of knowledge of these threats and careless behavior.

How to avoid installation of malware

To prevent this situation, be cautious when browsing the internet and downloading/installing/updating software. Carefully analyze all received email attachments. If the file/link is irrelevant, do not open anything. Attachments received from suspicious/unrecognizable email addresses should be ignored.

Download software from official sources only, using direct download links. Third party downloaders/installers are often used to proliferate malware, and thus these tools should be avoided. The same applies to software updates.

Keep installed apps and operating systems up-to-date, however, this should be achieved only through implemented functions or tools provided by the official developer. Software piracy is a cyber crime and the risk of infection is high. Therefore, never attempt to crack any applications.

The same applies to downloading software that is already cracked. Have a reputable anti-virus/anti-spyware suite installed and running.

These tools detect and eliminate malware before the system is harmed. The key to computer safety is caution. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus For Windows to automatically eliminate infiltrated malware.

 

What is Raccoon Stealer?

Raccoon Stealer is an information-stealing malware that is usually delivered through email. It retrieves sensitive data from infected machines and is available as Malware-as-a-service (MaaS). This means anyone can buy and use this malware for malicious purposes.

Attack on Central Government Entities

The NTRO wrote to the affected agencies on March 24 to inform them of the attack. According to the intelligence agency, a recent analysis revealed that a malicious campaign was launched “by an unknown threat actor using Raccoon malware” to target computer systems of the Central Board of Direct Taxes of the Income Tax department, the pay and accounts department of the Central Public Works Department, the office of the IG of CRPF, the DG of the NSG, the assistant director (admin) of the Sashastra Seema Bal, the Centre for Social Tech of NCERT, a joint director of the National Institute of Disaster Management, and a call center of the Sports Authority of India at JLN Stadium.

Impact on Government Agencies

The attack on these government agencies has raised concerns about the security of sensitive data. The Raccoon Stealer malware can retrieve sensitive data, such as personal information, financial data, and login credentials. The attack has also highlighted the need for better cybersecurity measures in government agencies.

How does Racoon Spyware Works?

Raccoon Infostealer is malicious software that infects computers and steals personal information, including email addresses, identification numbers, bank account information, and cryptocurrency information. Criminal actors can use the stolen information to commit identity theft, financial fraud, or other crimes.

How to Get Rid of Racoon Stealer:

1. STEP 1: Start your computer in Safe Mode with Networking.
2. STEP 2: Use Malwarebytes to remove Trojan:Win32/Raccoon.
3. STEP 3: Scan and clean your computer with HitmanPro.
4. STEP 4: Double-check for Trojan:Win32/Raccoon malware with ESET Online Scanner.
5. STEP 5: Use AdwCleaner to remove malicious browser policies.

 

 Blog By : Trupti Thakur