February 25, 2020 By David Bisson 2 min read

Security researchers discovered the Raccoon malware family is capable of stealing information from approximately 60 applications.

CyberArk found that Raccoon malware used the same procedure to target each application. It began by obtaining the app file that contains a user’s sensitive information. The threat then copied the file to its working folder before performing specific routines to extract and decrypt the data.

For instance, in the case of 29 Chromium-based browsers, Raccoon used sqlite3.dll to perform SQL queries against the SQLite databases housed within the “User Data” app folder. This behavior enabled the malware to obtain credit card information, browsing history, cookies and auto-login passwords.

After obtaining the data it wanted, Raccoon wrote a text file with the stolen information to its working folder. Next, it gathered all such text files into a single .zip file called “Log.zip.” The malware finished up by sending this file back to its command-and-control (C&C) server.

At the time of CyberArk’s writing, digital attackers could purchase access to Raccoon’s malware-as-a-service (MaaS) offering on the dark web for $75/week or $200/month.

Raccoon Malware’s Reception Among Digital Criminals

Raccoon has received positive feedback on underground web marketplaces. According to Cybereason, many threat actors endorsed the capabilities of the MaaS family. Some even went on to name it as a worthy replacement for the AZORult stealer. Such endorsements no doubt contributed to spikes in activity involving Raccoon malware, as observed by Recorded Future in April 2019.

That being said, Cybereason found that some advanced digital criminals rejected the malware for its lack of sophistication, features and innovation.

Defend Against MaaS Offerings With Smart Threat Detection

Security professionals need to be wary of the rise of MaaS families like Raccoon. The malware-as-a-service industry enables all types of digital criminals — even those without technical skills — to gain access to sophisticated malicious programs and make a profit from them. This model supports ongoing innovation in terms of malware capabilities, thereby further threatening the users and data that infosec personnel defend.

That being said, security professionals can help protect their organizations against threats like Raccoon malware by using artificial intelligence (AI) and machine learning to detect malicious activity, including evasive measures and attempts at exfiltrating data from the organization. They should also consider investing in a unified endpoint management (UEM) solution to gain visibility into any anomalous endpoint behavior.

More from

Exploiting GOG Galaxy XPC service for privilege escalation in macOS

7 min read - Being part of the Adversary Services team at IBM, it is important to keep your skills up to date and learn new things constantly. macOS security was one field where I decided to put more effort this year to further improve my exploitation and operation skills in macOS environments.During my research, I decided to try and discover vulnerabilities in software that I had pre-installed on my laptop, which resulted in the discovery of this vulnerability. In this article, I will…

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today