A relatively new malware called Racoon can steal data from around 60 applications on a computer.
Racoon was first spotted a year ago and quickly became known for its low price and capabilities. Also known as Legion, Mohazo and Racealer, the software was initially promoted only on Russian forums, but soon became known worldwide. The malware was first introduced in April 2019, under the MaaS (Malware-as-Service) model for $75 per week or $200 per month. For this money, its users gain access to an administration panel that allows them to customize Racoon according to their needs, access stolen data and download the software.
The MaaS model is widely available today because it “opens doors” to a large number of customers, many of whom lack the technical knowledge.
CyberArk reported that the software is written in C++ and is not at all complex. However, it can steal information from almost 60 programs (browsers, portfolios, emails, etc.). All popular browsers (Google Chrome, Mozilla Firefox, Microsoft Edge, Internet Explorer, Opera, Vivaldi, Waterfox, SeaMonkey, UC Browser) are on the list of targets. It also searches for cryptocurrency portfolios such as Electrum, Ethereum, Exodus, Jaxx and Monero. From emails, Racoon searches for data from Thunderbird, Outlook, Foxmail, etc.
CyberArk researchers say Racoon relies on a process to steal data: it locates and copies the file with useful information and creates a .zip file ready for theft. “After applying its capabilities, it gathers all the files it wrote into a Log.zip file. Now all it has to do is send the file back to the C&C server and erase its trail.” – CyberArk
Additional capabilities of Racoon include collecting operating system details (OS version and architecture, language, hardware information, etc.). It can also be easily customized to take screenshots of infected systems. In addition, the malware can act as a dropper for other malicious files.
Like all malware, Racoon is actively improving with frequent updates, new features, and capabilities. While analyzing it, researchers noticed new versions being released that expanded support for applications, adding FileZilla and UC Browser, and added the option to encrypt the software directly from the admin panel.
