--- title: "Raccoon Stealer: A popular and dangerous threat" description: Raccoon Stealer, also known as Mohazo or Racealer, is an info-stealer malware that first appeared in 2019, and is available as malware-as-a-service (MAAS). Available as MaaS, it has already infected over 100,000 devices in the wild, across organizations and individuals, and became one of the most-mentioned attacks on underground forums. canonical_url: https://www.acronis.com/en/tru/posts/raccoon-stealer-a-popular-and-dangerous-threat/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 04 May 2023 # Raccoon Stealer: A popular and dangerous threat Raccoon Stealer, also known as Mohazo or Racealer, is an info-stealer malware that first appeared in 2019, and is available as malware-as-a-service (MAAS). Available as MaaS, it has already infected over 100,000 devices in the wild, across organizations and individuals, and became one of the most-mentioned attacks on underground forums. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** ## Summary * Sold as malware-as-a-service on underground forums since 2019 * Sample is PE32 executable, written in C/C++ * Capable of stealing passwords, cookies, and crypto wallet data * Impersonates the product “ESET Security” * Packed with custom packer ## Introduction Raccoon Stealer, also known as Mohazo or Racealer, is an info-stealer malware that first appeared in 2019, and is available as malware-as-a-service (MaaS). It can be obtained from cybercriminal forums; a subscription costs $200 per month. Raccoon Stealer has already infected over 100,000 devices in the wild, across organizations and individuals, and became one of the most-mentioned attacks on underground forums. The malware is used to steal data like credit card information, nearly all existing desktop cryptocurrencies wallets, cookies, and passwords. Raccoon Stealer performs SQL queries using sqlite3.dll in order to get the user’s auto-login passwords, credit card details, cookies, and browser history. Raccoon Stealer is usually delivered through exploit kits and phishing attacks. The FBI has identified many credentials stolen by this group. A website was created for any individuals who want to check whether their email address appears in the cache of stolen data. ## Technical analysis Upon performing the static analysis, it is clear that the sample is an x32 architecture portable executable binary written in C/C++ and works on a 32-bit operating system. ![Image 1: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/cd1aea608cc8c3fe47cd35716e1aa654.png) This executable has a high entropy value in total (7.66444), and the section rsrc has an unusual entropy of 7.79713, which can indicate the presence of encrypted, compressed, encoded, and/or obfuscated data in the file. Furthermore, PE section 1 has an unusual name: zqHWbqh. ![Image 2: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/a8a1ec8032d95f8ba61d164ed4923862.png) Upon peering further into the executable, the packer that was used is a custom one, appearing as simple numbers to make the research process more difficult. ![Image 3: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/052d6ba19ecc6ace8b818a79db6f778a.png) ![Image 4: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/5964c5d81931a2866b8345a69587fb21.png) In the malware file description, it says “ESET Live Installer” in order to impersonate the AV engine installer and further fool victims. ![Image 5: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/842d9951965e66cc60bcdb0c4eec021a.png) When checking the resources, there is a file signature of “rcdata,” which has high entropy, and the language is identified as Russian. ![Image 6: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/2b54fee5db3126d1a58bedf572a80c83.png) In the sample’s sections, there are two modules noted. It’s immediately clear that the malware has multiple calls to sleep with a high number of seconds. This is an evasion mechanism used by many malware strings to avoid being automatically analyzed inside a free sandbox, as most of the free sandboxes will limit the amount of execution time. ![Image 7: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/05ce96ccd6a4965208852a732dbf1320.png) In addition, the sample uses the function GetSystemInfo to check the number of CPU cores, in an attempt to avoid being run in a lab environment. As an additional layer of protection, Raccoon Stealer invokes the IsDebuggerPresent API to check if it’s being debugged. Raccoon Stealer begins execution by obtaining the locale identifier for the user language. If the default locale is in Russian, the malware will not execute. ![Image 8: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/f6a4e3d116119a401e4c21d5434ee0a0.png) ![Image 9: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/0f05d2616b966c680a53efc5c97c6f5c.png) Next, the malware tries to create a mutex with MUTEX_ALL_ACCESS rights. Using this access right increases the possibility that the malware must be run by an administrator. ![Image 10: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/0772daec30e98922f052d893ddf9df6c.png) At the same time, the stealer spawns three new processes: AppLaunch.exe, raccoon.exe, and WerFault.exe. The child processes are terminated almost immediately, only functioning as a pipe for the malware to inject the malicious payload into the memory of a legitimate process — APPLaunch.exe, which is the Microsoft .NET ClickOnce Launch Utility. ![Image 11: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/7a3e33b043f9e8e00c3f493e666cf62f.png) WerFault.exe is the standard Windows error reporting tool used in Windows 10 and 11, allowing the system to track and report errors related to the operating system or applications. Antivirus engines commonly trust WerFault as it's a legitimate Windows executable signed by Microsoft, so launching it on the system won't usually trigger alerts to warn the victim. However, in this case, it uses a known DLL sideloading flaw to load the malicious DLL. Raccoon Stealer attempts to steal data from the Bitwarden and 1Password password managers, and also from the Atomic cryptocurrency wallet. Attempts to steal Bitwarden data are done by accessing the JSON file under the path _%APPDATA%\bitwarden\data.json_. ![Image 12: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/46d46531806f6d9215a60c26cc47e34e.png) In addition to exfiltrating information, Raccoon Stealer can also take screenshots of the system. The malware creates a snapshot that includes all running process on the system with it. ![Image 13: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/754f7b15a21a4ddaa6cdbba8b34fc920.png) Raccoon Stealer also searches the infected host for email information. ![Image 14: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/a6843c52d7c1a104d2c9b8fffd66bf2e.png) After retrieving the sought information, the stealer performs communication with the Telegram IP 149.143.167.99 in order to update its C2 address list. The attackers behind Raccoon Stealer have been found using a chat app to store and update C2 addresses to spread within infected machines. ![Image 15: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/3a6cebc92544fbb6a171d15c6aa6a6ec.png) As an additional step in creating communication, one of the child processes of the malware — APPLaunch.exe — attempts DNS queries to the actor-controlled domain. ![Image 16: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/2c8c8a46138d0298409fffe3ba9100eb.png) ![Image 17: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/323c477fcbaf5f4e8ea75afb6f857298.png) After being executed, Raccoon Stealer creates a suspended mode process to inject code. Once the process is complete, both the Raccoon and WerFault objects are deleted. AppLaunch continues to run in the background and connects to a remote address when needed. ## Conclusion Raccoon Stealer made a lot of noise in the underground community in 2019 when it was first released.Despite being around for several years, this malware remains popular and has managed to infect a significant number of devices. One reason for this is that the Raccoon Stealer team offers genuine customer service, providing cybercriminals with an easy and low-cost way to engage in cybercrime. This stealthy/sneaky malware is designed to gather data in small increments as it progresses, storing it until it can be transmitted in a single compressed file using Telegram for data exfiltration and infrastructure updates. With its up-to-date techniques and underground customer service, it is no wonder that Racoon Stealer remains popular to this day. ## Detected by Acronis Acronis Cyber Protect successfully detects and prevents execution of all known versions of Raccoon Stealer, before any harm can befall the system. ![Image 18: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/777fef1e5c1d892f52df26af52fc1305.png) ![Image 19: Raccoon Stealer: A popular and dangerous threat](https://staticfiles.acronis.com/images/content/6cfd678f2d5de2fd73918d7b50b3bae6.png) ## Indicators of compromise (IoCs) **Type** **Indicator** **Description** MD5 a680ae77d7dcbc614386f1b4ae2d6574 Packed Raccoon Stealer payload SHA-256 e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742 Packed Raccoon Stealer payload Import hash d86b72152e3eb79509e879927a109d7c Packed unique PE import hash shared by Raccoon Stealer payload MD5 8a45293860c097c76de004e96bfe677a Unpacked Raccoon Stealer payload SHA-256 88a3b41a55f81d44834d3867f56993ea03cccd26f0878d17b117faf3f17ac501 Unpacked Raccoon Stealer payload Import hash 2f1bba23d3f31d886fd20c963bc55038 Unpacked unique PE import hash Domain telegin[.]top Malicious domain Domain tgmirror[.]top Malicious domain Domain telemirror[.]top Malicious domain Domain Telegka[.]top Malicious domain Domain Telegatt[.]top Malicious domain Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)