Raccoon Stealer v2 Technical Intelligence Dossier

Executive Summary & Threat Architecture

Raccoon Stealer (also tracked as RecordBreaker, Trojan:Win32/Raccoon, and Race Stealer) is a premier commercial information stealer written in C/C++ that emerged on Russian-language underground cybercrime forums in April 2019. Marketed under an aggressive Malware-as-a-Service (MaaS) rental model for $200 per month, Raccoon quickly became one of the top three most prevalent information stealers in the world alongside RedLine and Vidar. Raccoon was engineered for rapid, multi-threaded credential harvesting: it sweeps across infected Windows endpoints, targeting stored passwords, autofill form entries, credit card vaults, and session cookies from over 60 Chromium and Gecko-based browsers. It comprehensively targets cryptocurrency assets, extracting desktop wallet files (Bitcoin-Core, Electrum, Exodus, Atomic) and over 40 browser Web3 wallet extensions (including MetaMask, Phantom, and TronLink), alongside session tokens from Discord, Telegram, and Steam. In mid-2022, following a brief operational pause due to the Russian-Ukrainian conflict, the developers launched 'Raccoon Stealer v2' (RecordBreaker), entirely re-written in native C with a tiny 50KB footprint, faster string searching, and encrypted C2 communications using RC4 and base64. In October 2022, the U.S. Department of Justice unsealed an indictment against primary administrator Mark Sokolovsky following his arrest in the Netherlands, accompanied by an international takedown of Raccoon's C2 infrastructure and CISA Advisory AA22-297A.

Observed Threat Aliases: Raccoon Stealer, RecordBreaker, Trojan:Win32/Raccoon, Win32/RaccoonStealer, Race Stealer

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: Proprietary origin

Documented Downstream Variants: raccoon_v1, raccoon_v2_recordbreaker

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by Raccoon Stealer v2 operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Search engine malvertising delivering malicious software installers (Notepad++, Blender, Tor Browser)
• YouTube videos promoting cracked games, software keys, and cryptocurrency mining bots
• Weaponized archives exploiting WinRAR vulnerability CVE-2023-38831

Host Persistence & Execution Hooks

• Single-run execution model: executes in %TEMP%, harvests credentials, exfiltrates, and deletes itself
• Scheduled tasks created under randomized names for extended persistence in specific affiliate campaigns
• Temporary dropping of sqlite3.dll and nss3.dll support libraries into %PROGRAMDATA%

Reference File Hashes (SHA-256)

• 098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a
• 671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b