MALWARE FAMILY

Raccoon

Internal ID: win.raccoon

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Raccoon Stealer is a malware reportedly sold for $75 a week or $200 a month. It gathers personal information including passwords, browser cookies and autofill data, as well as cryptowallet details. Additionally, Raccoon Stealer records system information such as IP addresses and geo-location data.

Threat Analysis

Raccoon is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://any.run/cybersecurity-blog/raccoon-stealer-v2-malware-analysis/

→https://asec.ahnlab.com/en/35981/

→https://asec.ahnlab.com/ko/25837/

→https://blog.checkpoint.com/2022/05/10/a-german-car-attack-on-german-vehicle-businesses/

→https://blog.cyble.com/2021/10/21/raccoon-stealer-under-the-lens-a-deep-dive-analysis/

→https://blog.malwarebytes.com/social-engineering/2020/09/malvertising-campaigns-come-back-in-full-swing/

→https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/

→https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/

→https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/

→https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.raccoon

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Raccoon