Blog

November 8, 2022

[Part 2] Typical Steps of a Raccoon Stealer v2 Infection

Nov 2022

Since the release of version 2 of Raccoon Stealer, Darktrace’s SOC has observed a surge in activity. See the typical steps used by this new threat!

Raccoon Stealer Malware

Since the release of version 2 of Raccoon Stealer in May 2022, Darktrace has observed huge volumes of Raccoon Stealer v2 infections across its client base. The info-stealer, which seeks to obtain and then exfiltrate sensitive data saved on users’ devices, displays a predictable pattern of network activity once it is executed. In this blog post, we will provide details of this pattern of activity, with the goal of helping security teams to recognize network-based signs of Raccoon Stealer v2 infection within their own networks.

What is Raccoon Stealer?

Raccoon Stealer is a classic example of information-stealing malware, which cybercriminals typically use to gain possession of sensitive data saved in users’ browsers and cryptocurrency wallets. In the case of browsers, targeted data typically includes cookies, saved login details, and saved credit card details. In the case of cryptocurrency wallets (henceforth, ‘crypto-wallets’), targeted data typically includes public keys, private keys, and seed phrases [1]. Once sensitive browser and crypto-wallet data is in the hands of cybercriminals, it will likely be used to conduct harmful activities, such as identity theft, cryptocurrency theft, and credit card fraud.

How do you obtain Raccoon Stealer?

Like most info-stealers, Raccoon Stealer is purchasable. The operators of Raccoon Stealer sell Raccoon Stealer samples to their customers (called ‘affiliates’), who then use the info-stealer to gain possession of sensitive data saved on users’ devices. Raccoon Stealer affiliates typically distribute their samples via SEO-promoted websites providing free or cracked software.

Is Raccoon Stealer Still Active?

On the 25^th of March 2022, the operators of Raccoon Stealer announced that they would be suspending their operations because one of their core developers had been killed during the Russia-Ukraine conflict [2]. The presence of the hardcoded RC4 key ‘edinayarossiya’ (Russian for ‘United Russia’) within observed Raccoon Stealer v2 samples [3] provides potential evidence of the Raccoon Stealer operators’ allegiances.

Recent details shared by the US Department of Justice [4]/[5] indicate that it was in fact the arrest, rather than the death, of an operator which led the Raccoon Stealer team to suspend their operations [6]. As a result of the FBI, along with law enforcement partners in Italy and the Netherlands, dismantling Raccoon Stealer infrastructure in March 2022 [4], the Raccoon Stealer team was forced to build a new version of the info-stealer.

On the 17^th May 2022, the completion of v2 of the info-stealer was announced on the Raccoon Stealer Telegram channel [7]. Since its release in May 2022, Raccoon Stealer v2 has become extremely popular amongst cybercriminals. The prevalence of Raccoon Stealer v2 in the wider landscape has been reflected in Darktrace’s client base, with hundreds of infections being observed within client networks on a monthly basis.

Since Darktrace’s SOC first saw a Raccoon Stealer v2 infection on the 22^nd May 2022, the info-stealer has undergone several subtle changes. However, the info-stealer’s general pattern of network activity has remained essentially unchanged.

How Does Raccoon Stealer v2 Infection Work?

A Raccoon Stealer v2 infection typically starts with a user attempting to download cracked or free software from an SEO-promoted website. Attempting to download software from one of these cracked/free software websites redirects the user’s browser (typically via several .xyz or .cfd endpoints) to a page providing download instructions. In May, June, and July, many of the patterns of download behavior observed by Darktrace’s SOC matched the pattern of behavior observed in a cracked software campaign reported by Avast in June [8].

Figure 1: Above is a webpage whose download instructions led to a Raccoon Stealer v2 sample hosted on Discord CDN

Figure 2: Above is an example of a webpage whose download instructions led to a Raccoon Stealer v2 sample hosted on Bitbucket

Following the instructions on the download instruction page causes the user’s device to download a password-protected RAR file from a file storage service such as ‘cdn.discordapp[.]com’, ‘mediafire[.]com’, ‘mega[.]nz’, or ‘bitbucket[.]org’. Opening the downloaded file causes the user’s device to execute Raccoon Stealer v2.

Figure 4: The Event Log for an infected device, taken from Darktrace’s Threat Visualiser interface, shows a device contacting two cracked software websites (‘crackedkey[.]org’ and ‘crackedpc[.]co’) before contacting a webpage (‘premiumdownload[.]org) providing instructions to download Raccoon Stealer v2 from Bitbucket

Once Raccoon Stealer v2 is running on a device, it will make an HTTP POST request with the target URI ‘/’ and an unusual user-agent string (such as ‘record’, ‘mozzzzzzzzzzz’, or ‘TakeMyPainBack’) to a C2 server. This POST request consists of three strings: a machine GUID, a username, and a 128-bit RC4 key [9]. The posted data has the following form:

machineId=X | Y & configId=Z (where X is a machine GUID, Y is a username and Z is a 128-bit RC4 key)

Figure 5:PCAP showing a device making an HTTP POST request with the User Agent header ‘record’

Figure 6: PCAP showing a device making an HTTP POST request with the User Agent header ‘mozzzzzzzzzzz’

Figure 7: PCAP showing a device making an HTTP POST request with the User Agent header ‘TakeMyPainBack’

The C2 server responds to the info-stealer’s HTTP POST request with custom-formatted configuration details. These configuration details consist of fields which tell the info-stealer what files to download, what data to steal, and what target URI to use in its subsequent exfiltration POST requests. Below is a list of the fields Darktrace has observed in the configuration details retrieved by Raccoon Stealer v2 samples:

a ‘libs_mozglue’ field, which specifies a download address for a Firefox library named ‘mozglue.dll’
a ‘libs_nss3’ field, which specifies a download address for a Network System Services (NSS) library named ‘nss3.dll’
a ‘libs_freebl3’ field, which specifies a download address for a Network System Services (NSS) library named ‘freebl3.dll’
a ‘libs_softokn3’ field, which specifies a download address for a Network System Services (NSS) library named ‘softokn3.dll’
a ‘libs_nssdbm3’ field, which specifies a download address for a Network System Services (NSS) library named ‘nssdbm3.dll’
a ‘libs_sqlite3’ field, which specifies a download address for a SQLite command-line program named ‘sqlite3.dll’
a ‘libs_ msvcp140’ field, which specifies a download address for a Visual C++ runtime library named ‘msvcp140.dll’
a ‘libs_vcruntime140’ field, which specifies a download address for a Visual C++ runtime library named ‘vcruntime140.dll’
a ‘ldr_1’ field, which specifies the download address for a follow-up payload for the sample to download
‘wlts_X’ fields (where X is the name of a crypto-wallet application), which specify data for the sample to obtain from the specified crypto-wallet application
‘ews_X’ fields (where X is the name of a crypto-wallet browser extension), which specify data for the sample to obtain from the specified browser extension
‘xtntns_X’ fields (where X is the name of a password manager browser extension), which specify data for the sample to obtain from the specified browser extension
a ‘tlgrm_Telegram’ field, which specifies data for the sample to obtain from the Telegram Desktop application
a ‘grbr_Desktop’ field, which specifies data within a local ‘Desktop’ folder for the sample to obtain
a ‘grbr_Documents’ field, which specifies data within a local ‘Documents’ folder for the sample to obtain
a ‘grbr_Recent’ field, which specifies data within a local ‘Recent’ folder for the sample to obtain
a ‘grbr_Downloads’ field, which specifies data within a local ‘Downloads’ folder for the sample to obtain
a ‘sstmnfo_System Info.txt’ field, which specifies whether the sample should gather and exfiltrate a profile of the infected host
a ‘scrnsht_Screenshot.jpeg’ field, which specifies whether the sample should take and exfiltrate screenshots of the infected host
a ‘token’ field, which specifies a 32-length string of hexadecimal digits for the sample to use as the target URI of its HTTP POST requests containing stolen data

After retrieving its configuration data, Raccoon Stealer v2 downloads the library files specified in the ‘libs_’ fields. Unusual user-agent strings (such as ‘record’, ‘qwrqrwrqwrqwr’, and ‘TakeMyPainBack’) are used in the HTTP GET requests for these library files. In all Raccoon Stealer v2 infections seen by Darktrace, the paths of the URLs specified in the ‘libs_’ fields have the following form:

/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/X (where X is the name of the targeted DLL file)

Figure 8: Advanced Search logs for an infected host, found on Darktrace’s Advanced Search interface, show a device making an HTTP POST request to retrieve configuration details, and then making HTTP GET requests with the User Agent header ‘record’ for DLL files

Raccoon Stealer v2 uses the DLLs which it downloads to gain access to sensitive data (such as cookies, credit card details, and login details) saved in browsers running on the infected host.

Depending on the data provided in the configuration details, Raccoon Stealer v2 will typically seek to obtain, in addition to sensitive data saved in browsers, the following information:

Information about the Operating System and applications installed on the infected host
Data from specified crypto-wallet software
Data from specified crypto-wallet browser extensions
Data from specified local folders
Data from Telegram Desktop
Data from specified password manager browser extensions
Screenshots of the infected host

Raccoon Stealer v2 exfiltrates the data which it obtains to its C2 server by making HTTP POST requests with unusual user-agent strings (such as ‘record’, ‘rc2.0/client’, ‘rqwrwqrqwrqw’, and ‘TakeMyPainBack’) and target URIs matching the 32-length string of hexadecimal digits specified in the ‘token’ field of the configuration details. The stolen data exfiltrated by Raccoon Stealer typically includes files named ‘System Info.txt’, ‘---Screenshot.jpeg’, ‘\cookies.txt’, and ‘\passwords.txt’.

If a ‘ldr_1’ field is present in the retrieved configuration details, then Raccoon Stealer will complete its operation by downloading the binary file specified in the ‘ldr_1’ field. In all observed cases, the paths of the URLs specified in the ‘ldr_1’ field end in a sequence of digits, followed by ‘.bin’. The follow-up payload seems to vary between infections, likely due to this additional-payload feature being customizable by Raccoon Stealer affiliates. In many cases, the info-stealer, CryptBot, was delivered as the follow-up payload.

Darktrace Coverage of Raccoon Stealer

Once a user’s device becomes infected with Raccoon Stealer v2, it will immediately start to communicate over HTTP with a C2 server. The HTTP requests made by the info-stealer have an empty Host header (although Host headers were used by early v2 samples) and highly unusual User Agent headers. When Raccoon Stealer v2 was first observed in May 2022, the user-agent string ‘record’ was used in its HTTP requests. Since then, it appears that the operators of Raccoon Stealer have made several changes to the user-agent strings used by the info-stealer, likely in an attempt to evade signature-based detections. Below is a timeline of the changes to the info-stealer’s user-agent strings, as observed by Darktrace’s SOC:

22^nd May 2022: Samples seen using the user-agent string ‘record’
2^nd July 2022: Samples seen using the user-agent string ‘mozzzzzzzzzzz’
29^th July 2022: Samples seen using the user-agent string ‘rc2.0/client’
10^th August 2022: Samples seen using the user-agent strings ‘qwrqrwrqwrqwr’ and ‘rqwrwqrqwrqw’
16^th Sep 2022: Samples seen using the user-agent string ‘TakeMyPainBack’

The presence of these highly unusual user-agent strings within infected devices’ HTTP requests causes the following Darktrace DETECT/Network models to breach:

Device / New User Agent
Device / New User Agent and New IP
Anomalous Connection / New User Agent to IP Without Hostname
Device / Three or More New User Agents

These DETECT models look for devices making HTTP requests with unusual user-agent strings, rather than specific user-agent strings which are known to be malicious. This method of detection enables the models to continually identify Raccoon Stealer v2 HTTP traffic, despite the changes made to the info-stealer’s user-agent strings.

After retrieving configuration details from a C2 server, Raccoon Stealer v2 samples make HTTP GET requests for several DLL libraries. Since these GET requests are directed towards highly unusual IP addresses, the downloads of the DLLs cause the following DETECT models to breach:

Anomalous File / EXE from Rare External Location
Anomalous File / Script from Rare External Location
Anomalous File / Multiple EXE from Rare External Locations

Raccoon Stealer v2 samples send data to their C2 server via HTTP POST requests with an absent Host header. Since these POST requests lack a Host header and have a highly unusual destination IP, their occurrence causes the following DETECT model to breach:

Anomalous Connection / Posting HTTP to IP Without Hostname

Certain Raccoon Stealer v2 samples download (over HTTP) a follow-up payload once they have exfiltrated data. Since the target URIs of the HTTP GET requests made by v2 samples end in a sequence of digits followed by ‘.bin’, the samples’ downloads of follow-up payloads cause the following DETECT model to breach:

Anomalous File / Numeric File Download

If Darktrace RESPOND/Network is configured within a customer’s environment, then Raccoon Stealer v2 activity should cause the following inhibitive actions to be autonomously taken on infected systems:

Enforce pattern of life — This action results in a device only being able to make connections which are normal for it to make
Enforce group pattern of life — This action results in a device only being able to make connections which are normal for it or any of its peers to make
Block matching connections — This action results in a device being unable to make connections to particular IP/Port pairs
Block all outgoing traffic — This action results in a device being unable to make any connections

Given that Raccoon Stealer v2 infections move extremely fast, with the time between initial infection and data exfiltration sometimes less than a minute, the availability of Autonomous Response technology such as Darktrace RESPOND is vital for the containment of Raccoon Stealer v2 infections.

Timeline of Darktrace stopping raccoon stealer. — Figure 16: Figure displaying the steps of a Raccoon Stealer v2 infection, along with the corresponding Darktrace detections

Conclusion

Since the release of Raccoon Stealer v2 back in 2022, the info-stealer has relentlessly infected the devices of unsuspecting users. Once the info-stealer infects a user’s device, it retrieves and then exfiltrates sensitive information within a matter of minutes. The distinctive pattern of network behavior displayed by Raccoon Stealer v2 makes the info-stealer easy to spot. However, the changes which the Raccoon Stealer operators make to the User Agent headers of the info-stealer’s HTTP requests make anomaly-based methods key for the detection of the info-stealer’s HTTP traffic. The operators of Raccoon Stealer can easily change the superficial features of their malware’s C2 traffic, however, they cannot easily change the fact that their malware causes highly unusual network behavior. Spotting this behavior, and then autonomously responding to it, is likely the best bet which organizations have at stopping a Raccoon once it gets inside their networks.

Thanks to the Threat Research Team for its contributions to this blog.

References

[1] https://www.microsoft.com/security/blog/2022/05/17/in-hot-pursuit-of-cryware-defending-hot-wallets-from-attacks/

[2] https://twitter.com/3xp0rtblog/status/1507312171914461188

[3] https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-raccoon-stealer-v2-0

[4] https://www.justice.gov/usao-wdtx/pr/newly-unsealed-indictment-charges-ukrainian-national-international-cybercrime-operation

[5] https://www.youtube.com/watch?v=Fsz6acw-ZJ

[6] https://riskybiznews.substack.com/p/raccoon-stealer-dev-didnt-die-in

[7] https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d

[8] https://blog.avast.com/fakecrack-campaign

[9] https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/

Appendices

MITRE ATT&CK Mapping

Resource Development

• T1588.001 — Obtain Capabilities: Malware

• T1608.001 — Stage Capabilities: Upload Malware

• T1608.005 — Stage Capabilities: Link Target

• T1608.006 — Stage Capabilities: SEO Poisoning

Execution

• T1204.002 — User Execution: Malicious File

Credential Access

• T1555.003 — Credentials from Password Stores: Credentials from Web Browsers

• T1555.005 — Credentials from Password Stores: Password Managers

• T1552.001 — Unsecured Credentials: Credentials In Files

Command and Control

• T1071.001 — Application Layer Protocol: Web Protocols

• T1105 — Ingress Tool Transfer

IOCS

Type

IOC

Description

User-Agent String

record

String used in User Agent header of Raccoon Stealer v2’s HTTP requests

User-Agent String

mozzzzzzzzzzz

String used inUser Agent header of Raccoon Stealer v2’s HTTP requests

User-Agent String

rc2.0/client

String used in User Agent header of Raccoon Stealer v2’s HTTP requests

User-Agent String

qwrqrwrqwrqwr

String used in User Agent header of Raccoon Stealer v2’s HTTP requests

User-Agent String

rqwrwqrqwrqw

String used in User Agent header of Raccoon Stealer v2’s HTTP requests

User-Agent String

TakeMyPainBack

String used in User Agent header of Raccoon Stealer v2’s HTTP requests

Domain Name

brain-lover[.]xyz