{
  "family": "raccoon",
  "sample_count": 110,
  "category": "infostealer",
  "description": "Raccoon Stealer (also tracked as RecordBreaker, Trojan:Win32/Raccoon, and Race Stealer) is a premier commercial information stealer written in C/C++ that emerged on Russian-language underground cybercrime forums in April 2019. Marketed under an aggressive Malware-as-a-Service (MaaS) rental model for $200 per month, Raccoon quickly became one of the top three most prevalent information stealers in the world alongside RedLine and Vidar. Raccoon was engineered for rapid, multi-threaded credential harvesting: it sweeps across infected Windows endpoints, targeting stored passwords, autofill form entries, credit card vaults, and session cookies from over 60 Chromium and Gecko-based browsers. It comprehensively targets cryptocurrency assets, extracting desktop wallet files (Bitcoin-Core, Electrum, Exodus, Atomic) and over 40 browser Web3 wallet extensions (including MetaMask, Phantom, and TronLink), alongside session tokens from Discord, Telegram, and Steam. In mid-2022, following a brief operational pause due to the Russian-Ukrainian conflict, the developers launched 'Raccoon Stealer v2' (RecordBreaker), entirely re-written in native C with a tiny 50KB footprint, faster string searching, and encrypted C2 communications using RC4 and base64. In October 2022, the U.S. Department of Justice unsealed an indictment against primary administrator Mark Sokolovsky following his arrest in the Netherlands, accompanied by an international takedown of Raccoon's C2 infrastructure and CISA Advisory AA22-297A.",
  "cta": "Published by the SystemHelpdesk threat intelligence team.",
  "aliases": [
    "Raccoon Stealer",
    "RecordBreaker",
    "Trojan:Win32/Raccoon",
    "Win32/RaccoonStealer",
    "Race Stealer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Raccoon Stealer and how was it sold?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Raccoon Stealer is a commercial C/C++ information stealer sold as a subscription (Malware-as-a-Service) on underground cybercrime forums starting in 2019."
      }
    },
    {
      "@type": "Question",
      "name": "What made Raccoon v2 (RecordBreaker) different from v1?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Raccoon v2 was completely rewritten in C with a footprint under 50KB, reduced external dependencies, faster in-memory parsing of browser SQLite databases, and upgraded C2 encryption."
      }
    },
    {
      "@type": "Question",
      "name": "What data does Raccoon Stealer harvest?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Raccoon targets passwords, cookies, credit cards, cryptocurrency wallet files and extensions, Discord tokens, Telegram sessions, and system hardware specifications."
      }
    },
    {
      "@type": "Question",
      "name": "What happened during the October 2022 law enforcement takedown?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The FBI, Dutch Police, and Italian authorities arrested primary administrator Mark Sokolovsky and dismantled the central Raccoon server infrastructure, leading to CISA Advisory AA22-297A."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect against Raccoon Stealer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disable browser password saving in favor of managed enterprise password solutions, enforce hardware multi-factor authentication, and deploy endpoint behavioral rules detecting unauthorized access to browser User Data folders."
      }
    },
    {
      "@type": "Question",
      "name": "How does Raccoon Stealer locate and decrypt browser master passwords and cryptocurrency wallet private keys?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Raccoon Stealer scans endpoint directories for Chromium-based and Gecko-based browser storage folders. It extracts the encrypted AES master key from the 'Local State' file by calling the Windows CryptUnprotectData DPAPI function. Using this decrypted key, it decrypts saved passwords, cookies, and autofill entries stored in 'Login Data' SQLite databases. It also scans filesystem paths for over 30 cryptocurrency desktop wallet extensions and cold wallet files (e.g., wallet.dat, Exodus, MetaMask)."
      }
    },
    {
      "@type": "Question",
      "name": "What communication protocols and Telegram API integrations did Raccoon Stealer v2 introduce?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Raccoon Stealer v2 was rewritten entirely in C/C++ to eliminate external runtime dependencies. For C2 discovery, Raccoon queries public Telegram channels, Steam community profiles, and VKontakte pages where threat actors post base64-encoded C2 IP addresses. The stealer dynamically resolves active command servers from these dead-drop resolvers before transmitting multi-part zip archives of stolen credentials via HTTP POST."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1555.003",
    "T1539",
    "T1005",
    "T1082",
    "T1083",
    "T1071.001",
    "T1041",
    "T1027"
  ],
  "cisa_advisory": "AA22-297A",
  "exploited_cves": [
    "CVE-2023-38831"
  ],
  "iocs": {
    "file_hashes": [
      "098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a",
      "671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b"
    ],
    "delivery": [
      "Search engine malvertising delivering malicious software installers (Notepad++, Blender, Tor Browser)",
      "YouTube videos promoting cracked games, software keys, and cryptocurrency mining bots",
      "Weaponized archives exploiting WinRAR vulnerability CVE-2023-38831"
    ],
    "persistence": [
      "Single-run execution model: executes in %TEMP%, harvests credentials, exfiltrates, and deletes itself",
      "Scheduled tasks created under randomized names for extended persistence in specific affiliate campaigns",
      "Temporary dropping of sqlite3.dll and nss3.dll support libraries into %PROGRAMDATA%"
    ]
  },
  "lineage": {
    "derived_from": [],
    "variants": [
      "raccoon_v1",
      "raccoon_v2_recordbreaker"
    ]
  },
  "ecosystem": [
    "windows",
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "credential_access",
    "discovery",
    "collection",
    "command_and_control",
    "exfiltration"
  ],
  "last_updated": "2026-10-16",
  "sources": [
    {
      "name": "CISA Advisory AA22-297A: FBI Disruption of Raccoon Stealer",
      "url": "https://www.cisa.gov/news-events/alerts/2022/10/25/fbi-releases-information-raccoon-stealer-malware"
    },
    {
      "name": "U.S. Department of Justice: Raccoon Stealer Administrator Indicted",
      "url": "https://www.justice.gov/opa/pr/authorities-four-countries-take-down-raccoon-stealer-malware"
    },
    {
      "name": "Mandiant: Dissecting Raccoon Stealer v2 RecordBreaker",
      "url": "https://www.mandiant.com/resources/blog/raccoon-stealer-v2"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}