S2W Racoon 2022

Raccoon Stealer collects data from victim machines based on configuration information received from command and control nodes.

Raccoon Stealer will automatically collect and exfiltrate data identified in received configuration files from command and control nodes.

Raccoon Stealer uses RC4 encryption for strings and command and control addresses to evade static detection.

Raccoon Stealer gathers information on the infected system owner and user.

Raccoon Stealer uses existing HTTP-based command and control channels for exfiltration.

Raccoon Stealer uses HTTP, and particularly HTTP POST requests, for command and control actions.

Raccoon Stealer gathers information on infected systems such as operating system, processor information, RAM, and display information.

Raccoon Stealer identifies target files and directories for collection based on a configuration file.

Raccoon Stealer downloads various library files enabling interaction with various data stores and structures to facilitate follow-on information theft.

Raccoon Stealer can capture screenshots from victim systems.

Raccoon Stealer collects files and directories from victim systems based on configuration data downloaded from command and control servers.

Raccoon Stealer gathers victim machine timezone information.

Raccoon Stealer uses RC4-encrypted, base64-encoded strings to obfuscate functionality and command and control servers.

Raccoon Stealer has been distributed through cracked software downloads.

Raccoon Stealer collects the `Locale Name` of the infected device via `GetUserDefaultLocaleName` to determine whether the string `ru` is included, but in analyzed samples no action is taken if present.