Sekoia Raccoon2 2022

Raccoon Stealer collects data from victim machines based on configuration information received from command and control nodes.

Raccoon Stealer queries the Windows Registry to fingerprint the infected host via the `HKLM:\SOFTWARE\Microsoft\Cryptography\MachineGuid` key.

Raccoon Stealer will automatically collect and exfiltrate data identified in received configuration files from command and control nodes.

Raccoon Stealer dynamically links key WinApi functions during execution.

Raccoon Stealer uses RC4 encryption for strings and command and control addresses to evade static detection.

Raccoon Stealer gathers information on the infected system owner and user.

Raccoon Stealer uses existing HTTP-based command and control channels for exfiltration.

Raccoon Stealer uses HTTP, and particularly HTTP POST requests, for command and control actions.

Raccoon Stealer gathers information on infected systems such as operating system, processor information, RAM, and display information.

Raccoon Stealer identifies target files and directories for collection based on a configuration file.

Raccoon Stealer checks the privileges of running processes to determine if the running user is equivalent to `NT Authority\System`.

Raccoon Stealer downloads various library files enabling interaction with various data stores and structures to facilitate follow-on information theft.

Raccoon Stealer can capture screenshots from victim systems.

Raccoon Stealer collects files and directories from victim systems based on configuration data downloaded from command and control servers.

Raccoon Stealer gathers victim machine timezone information.

Raccoon Stealer gathers information from repositories associated with cryptocurrency wallets and the Telegram messaging service.

Raccoon Stealer is capable of identifying running software on victim machines.

Raccoon Stealer attempts to steal cookies and related information in browser history.

Raccoon Stealer collects passwords, cookies, and autocomplete information from various popular web browsers.

Raccoon Stealer archives collected system information in a text f ile, `System info.txt`, prior to exfiltration.