Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)

Raccoon Stealer is an information stealer malware family active since at least 2019 as a malware-as-a-service offering sold in underground forums. Raccoon Stealer has experienced two periods of activity across two variants, from 2019 to March 2022, then resurfacing in a revised version in June 2022.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon1 2022)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Data from Information Repositories - T1213 (d28ef391-8ed4-45dc-bc4a-2f43abf54416)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
System Time Discovery - T1124 (f3c544dc-673c-4ef3-accb-53229f1ae077)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Local Account - T1087.001 (25659dd6-ea12-45c4-97e6-381e3e4b593e)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Steal Web Session Cookie - T1539 (10ffac09-e42d-4f56-ab20-db94c67d76ff)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Data from Local System - T1005 (3c4a2599-71ee-4405-ba1e-0e28414b4bc5)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Exfiltration Over C2 Channel - T1041 (92d7da27-2d91-488e-a00c-059dc162766d)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Automated Exfiltration - T1020 (774a3188-6ba9-4dc4-879d-d54ee48a5ce9)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
System Owner/User Discovery - T1033 (03d7999c-1f4c-42cc-8373-e7690d318104)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Encrypted/Encoded File - T1027.013 (0d91b3c0-5e50-47c3-949a-2a796f04d144)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Query Registry - T1012 (c32f7008-9fea-41f7-8366-5eb9b74bd896)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
System Location Discovery - T1614 (c877e33f-1df6-40d6-b1e7-ce70f16f4979)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Archive Collected Data - T1560 (53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Supply Chain Compromise - T1195 (3f18edba-28f4-4bb9-82c3-8aa60dcac5f7)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Credentials from Web Browsers - T1555.003 (58a3e6aa-4453-4cc8-a51f-4befe80b31a8)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Software Discovery - T1518 (e3b6daca-e963-4a69-aee6-ed4fd653ad58)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Dynamic API Resolution - T1027.007 (ea4c2f9c-9df1-477c-8c42-6da1118f2ac4)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Automated Collection - T1119 (30208d3e-0d6b-43c8-883e-44462a514619)	Attack Pattern	Raccoon Stealer - S1148 (b5a8fb8b-4ff1-43e5-a1ad-75ae565f5175)	Malware	1
Local Account - T1087.001 (25659dd6-ea12-45c4-97e6-381e3e4b593e)	Attack Pattern	Account Discovery - T1087 (72b74d71-8169-42aa-92e0-e7b04b9f5a08)	Attack Pattern	2
Encrypted/Encoded File - T1027.013 (0d91b3c0-5e50-47c3-949a-2a796f04d144)	Attack Pattern	Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	2
File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c)	Attack Pattern	Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69)	Attack Pattern	2
Credentials from Web Browsers - T1555.003 (58a3e6aa-4453-4cc8-a51f-4befe80b31a8)	Attack Pattern	Credentials from Password Stores - T1555 (3fc9b85a-2862-4363-a64d-d692e3ffbee0)	Attack Pattern	2
Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6)	Attack Pattern	Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161)	Attack Pattern	2
Dynamic API Resolution - T1027.007 (ea4c2f9c-9df1-477c-8c42-6da1118f2ac4)	Attack Pattern	Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	2