Raccoon Stealer returned in mid-2023 after a period of inactivity following the arrest of one of its operators. Version 3 represents a significant rewrite of the malware, but several core behaviors remain unchanged, making tracking and detection feasible for organizations that had existing signatures.
What Changed
Communication Protocol: v3 switched from HTTP-based C2 communication to a custom binary protocol over TCP. The protocol uses a simple handshake followed by encrypted data exchange. This change makes network-level detection more difficult but also makes the traffic more conspicuous on networks that monitor for unusual TCP connections.
Credential Extraction: The browser credential extraction module was completely rewritten. v3 supports Chromium-based browsers using the new App-Bound Encryption introduced in Chrome 127, which v2 could not bypass. It also added support for extracting passwords from the macOS Keychain.
Anti-Analysis: v3 includes more aggressive anti-sandbox checks, including timing-based detection that measures instruction execution speed to identify virtual environments. Our analysis sandbox required modifications to bypass these checks.
What Stayed the Same
Configuration Format: Despite the protocol changes, the configuration blob format is largely unchanged. This means existing tools for extracting C2 addresses from Raccoon configs still work with minor modifications.
File Collection: The file grabber module uses the same directory traversal and extension matching logic. The default target extensions (wallet files, documents, images) are identical to v2.
Exfiltration: Stolen data is still packaged into a ZIP archive before exfiltration. The archive structure is the same, making it possible to identify Raccoon exfiltration in network traffic by the archive signature pattern.