What Is Raccoon Stealer?
Raccoon Stealer (S1148) is an information-stealing malware designed to harvest personal and corporate data. First appearing in 2019, it operates as a highly successful Malware-as-a-Service (MaaS) operation. After a brief hiatus, developers released a major upgrade in 2022 known as version 2 or RecordBreaker. Inexperienced cybercriminals can rent the software on underground forums for a low monthly fee. Like Agent Tesla, it remains one of the most prolific credential harvesting tools on the market.
Threat actors distribute Raccoon Stealer through various channels. They heavily rely on phishing emails, malicious advertisements, and drive-by downloads. The malware frequently hides inside fake software installers or cracked versions of legitimate business tools packed with heavy obfuscation.
Once executed, Raccoon Stealer runs silently in the background without triggering pop-ups. It searches installed web browsers and applications for saved passwords, cookies, and autofill data by targeting internal SQLite databases. The malware specifically targets cryptocurrency wallets and messaging apps like Telegram. It can also capture screenshots and profile the infected operating system. The software uses RC4 encryption and Base64 encoding to obfuscate its activities, sending this stolen data in chunks to external command-and-control servers using HTTP POST requests. Because Raccoon Stealer also functions as a loader, attackers often use it to drop secondary payloads onto the compromised machine.
How to Defend Against Raccoon Stealer?
Defending against Raccoon Stealer requires strict software policies, endpoint behavioral monitoring, and automated threat intelligence.
- Secure software deployment: Raccoon Stealer spreads through cracked software and fake installers. Block users from downloading unapproved applications and enforce strict web filtering to stop drive-by downloads.
- Monitor endpoint behaviors: The malware executes quietly from temporary Windows folders. Deploy endpoint detection tools to inspect directories like AppData, LocalLow, and Temp for unusual hidden processes and unexpected DLL loads like sqlite3.dll or nss3.dll.
- Map the attack surface: Malware-as-a-Service operations rely on vulnerable, unmanaged entry points. Use platforms like Lumu Discover to continuously audit your attack surface and uncover exposed network assets.
- Track abnormal network behaviors: Raccoon Stealer exfiltrates stolen data using HTTP POST requests at irregular intervals. Deploy Network Detection and Response (NDR) platforms like Lumu Defender to flag these suspicious outbound connections, detect RC4-encrypted traffic anomalies, and block command-and-control communication.
- Block malicious indicators: Leverage threat intelligence platforms like Lumu Maltiverse to automatically correlate and block known infrastructure, domains, and IP addresses linked to Raccoon Stealer campaigns.
