Trash Panda as a Service: Raccoon Stealer Steals Cookies, Crypto, and More
Threat AdvisoryTLP:CLEAR Threat ReportsInfostealer Trash Panda as a Service: Raccoon Stealer Steals Cookies, Crypto, and More A $75-a-week stealer-as-a-service that harvests browser passwords, cookies and autofill, hijacks crypto transactions with a bundled…
- Infostealer
Bottom line. Treat any Raccoon Stealer detection as a full credential and session compromise, not a single-host malware event: force-reset passwords, invalidate browser session cookies and enable MFA on every service the victim touched, before the stolen data is sold on.
Background
Raccoon Stealer is a widely-used information stealer sold as a service rather than a standalone tool. Its developers run it like a commercial SaaS, perpetual development, regular feature and bug-fix updates, even auto-updates to already-deployed bots, controlled from a Tor-based command-and-control panel and marketed on Russian-language crime forums with English support. Each build is signature-tied to the customer, so a leaked sample can be traced back to the buyer.
This analysis is based on Sophos X-Ops research (Yusuf Arslan Polat and Sean Gallagher). It tracks a single high-volume campaign that made up the majority of recent Raccoon detections, distributed through a dropper-as-a-service and fake ‘cracked software’ websites.
What we observed
Across the analysed samples, the tradecraft breaks down as follows:
- Capability: Raccoon collects saved passwords, cookies and browser autofill (including stored credit-card data), and, via a clipper update, targets cryptocurrency wallets and can retrieve or drop additional files.
- Delivery: the campaign leaned on SEO-poisoned ‘warez/crack’ sites (e.g. gsmcracktools.blogspot.com, procrackerz.org) and YouTube promotion, serving password-protected self-extracting archives to evade scanning.
- C2 discovery: samples read an RC4-encrypted address from a hard-coded Telegram channel description (telete.in/jbitchsucks) to resolve the C2 ‘gate’, allowing the operators to rotate gates when one is blocked.
- Bundled payloads: the same droppers delivered crypto-miners (SilentXMRMiner), the QuilClipper clipboard-hijacker, malicious browser extensions, click-fraud bots and Djvu/STOP ransomware.
- Persistence: the miner copies itself to %TEMP%\RtkAudUService64.exe, adds an HKCU …\CurrentVersion\Run key, and uses RunPE process-hollowing to inject into a legitimate explorer.exe.
- Impact: in this campaign the operator stole roughly $13,200 in cryptocurrency and mined a further ~$2,900 over ~6 months, for about $1,250 in service fees, illustrating the economics that make infostealers so pervasive.
Raccoon Stealer kill chain
One dropper delivers many families: the stealer, an XMR miner, QuilClipper and ransomware.
Attribution
We assess with high confidence that this is financially motivated commodity cybercrime built on stacked criminal services (dropper-as-a-service + Raccoon stealer-as-a-service), not a state-aligned operation. QuilClipper samples reference the actor nickname ‘MickeyMF’; the registrant name ‘Marina Grodovich’ recurs across ~94 Raccoon gate domains. No single real-world identity is confirmed; these are handles and registration artefacts, not attribution to a named group.
Confidence: 80%.
Industrialised crime: for about $1,250 in service fees, one low-skill operator netted roughly $16,000. The stealer, the dropper, and the hosting were all just subscriptions.
Tactics, techniques & procedures (MITRE ATT&CK)
Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:
| Tactic | Technique | ID | Evidence |
|---|---|---|---|
| Execution | User Execution: Malicious File | T1204.002 | Victims run fake ‘cracked software’ installers delivered as self-extracting droppers. |
| Defense Evasion | Masquerading | T1036 | Payloads disguised as pirated software; SFX headers manipulated to block static unpacking. |
| Defense Evasion | Deobfuscate/Decode Files or Information | T1140 | RC4-decrypts the Telegram channel description to recover the C2 gate address. |
| Defense Evasion | Virtualization/Sandbox Evasion | T1497 | The .NET loader includes an anti-virtual-machine module. |
| Privilege Escalation | Process Injection: Process Hollowing | T1055.012 | RunPE injects the miner/clipper into a legitimate explorer.exe. |
| Persistence | Registry Run Keys | T1547.001 | Miner adds HKCU\…\CurrentVersion\Run for %TEMP%\RtkAudUService64.exe. |
| Credential Access | Credentials from Web Browsers | T1555.003 | Harvests saved browser passwords and autofill (incl. stored card data). |
| Credential Access | Steal Web Session Cookie | T1539 | Collects browser authentication cookies for session hijacking. |
| Collection | Clipboard Data | T1115 | QuilClipper monitors the clipboard to swap crypto/Steam addresses. |
| Collection | Screen Capture | T1113 | Captures a desktop screenshot (screen.jpg) in the exfil bundle. |
| Collection | Archive Collected Data | T1560 | Bundles stolen data into an archive before upload. |
| Discovery | System Information Discovery | T1082 | Gathers host details written to System Info.txt. |
| Command and Control | Web Service | T1102 | Uses a Telegram channel to resolve the C2 gate, enabling gate rotation. |
| Command and Control | Ingress Tool Transfer | T1105 | Downloads secondary payloads (SilentXMRMiner, QuilClipper) from the gate/host. |
| Impact | Resource Hijacking | T1496 | Deploys a SilentXMRMiner-based Monero miner on the victim. |
Campaign economics (USD)
~$16k gross from roughly $1,250 in criminal-service fees over ~6 months.
Indicators of compromise
Defenders can block or hunt the following:
| Indicator | Type | Note |
|---|---|---|
gsmcracktools[.]blogspot[.]com | domain | Fake ‘cracked software’ lure distributing the dropper |
procrackerz[.]org | domain | Fake ‘cracked software’ lure distributing the dropper |
f0473248[.]xsph[.]ru | domain | Second-stage payload host (miner/clipper); 18 payloads Oct 2020–Apr 2021 |
bbhmnn778[.]fun | domain | Hosts Raccoon Stealer and QuilClipper loaders |
aun3xk17k[.]space | domain | QuilClipper download domain seen in YouTube promo |
hxxps://telete[.]in/jbitchsucks | url | Telegram channel used to resolve the RC4-encrypted C2 gate address |
Raccoon C2 infrastructure map
Detection
Copy-ready hunting query:
index=windows (EventCode=1 OR EventCode=11 OR EventCode=13)
| search (Image="*\RtkAudUService64.exe"
OR TargetFilename="*\RtkAudUService64.exe"
OR (RegistryKeyPath="*\CurrentVersion\Run*" AND Details="*RtkAudUService64*"))
| stats count min(_time) as first_seen values(Image) as images by host, user
| sort first_seenRecommendations
- Treat browser-stored secrets on any infected host as compromised: force password resets, invalidate active session cookies, and enforce MFA on all touched services.
- Block and hunt the listed domains and the Telegram gate channel across DNS, proxy and EDR; import the SophosLabs Raccoon IoC set for full coverage.
- Prohibit cracked/pirated-software downloads and enforce application allow-listing; brief users that ‘software crack’ search results are a primary infection vector.
- Hunt for RunPE/process-hollowing into explorer.exe, the %TEMP%\RtkAudUService64.exe persistence key, and clipboard-address-swap (clipper) behaviour.
