How to remove Raccoon Stealer

What kind of malware is Raccoon Stealer?

Raccoon Stealer (also known as Legion, Mohazo, and Racealer) is high-risk trojan-type application that stealthily infiltrates the system and collects personal information. Having this trojan installed on your computer might lead to various issues. Furthermore, cyber criminals offer this trojan's services within hacker forums.

Therefore, any aspiring cyber criminal can purchase a subscription and generate revenue by misusing stolen data.

More about the Raccoon Stealer

As mentioned above, Raccoon Stealer gathers personal information. This includes passwords, browser cookies and autofill data, and cryptowallet details. Additionally, Raccoon Stealer records system information such as Internet Protocol (IP) addresses and geo-location. The data can be misused in various ways.

Cyber criminals might use it to transfer users' funds in cryptowallets and other accounts (e.g., PayPal, bank accounts, etc.). Victims could, therefore, lose their savings. Additionally, hijacked accounts (e.g., Facebook, emails, etc.) can be misused to borrow money.

Thus, victims might accrue significant debt. In addition, cyber criminals often use stolen contacts to proliferate malware by spamming malicious links/files to all contacts. Note that Raccoon Stealer developers aim to generate revenue by selling collected data, rather than misusing it themselves.

I.e., they offer a service that allows "subscribers" to access stolen data. Raccoon Stealer developers provide an admin panel, which allows subscribers to view and download chosen information (logs).

Raccoon Stealer is not the first (and certainly, not the last) malware infection that is sold on hacker forums, however, it is rather unique, since the buyer does not need to proliferate any malware. Raccoon Stealer developers are responsible for distribution, whilst the subscriber gains access only to the stored data and not the malicious executable (the malware programs).

In other more common cases, malware developers sell malicious executables, which buyers must then proliferate. Therefore, Raccoon Stealer gains a significant advantage, since this is a much more convenient for subscribers who are looking for generic personal data.

Raccoon Stealer developers offer a weekly/monthly subscription for a cost of $75/$200. This cost is low when considering the revenue that can potentially be generated. It is also worth mentioning that Raccoon Stealer can be used as a malware injection tool.

It is capable of downloading and executing additional files, which means that crooks might use it to infect systems with additional malware, such as ransomware or cryptominers. Fortunately, most anti-virus/anti-spyware suites are capable of detecting and eliminating Raccoon Stealer malware.

Therefore, if you suspect Raccoon Stealer's presence on your system, immediately scan the system with this software and eliminate all detected threats. Also change the passwords of all accounts. Bear in mind that using an identical password for multiple accounts is very unsafe.

Furthermore, we strongly advise you to use combinations of random uppercase/lowercase letters, digits and (if possible) symbols, since existing words and personal information (e.g., name, surname, birth date) are very easy to crack.

Threat Summary:

Name	Raccoon Stealer trojan
Threat Type	Trojan, Password-stealing virus, Banking malware, Spyware
Detection Names (2.exe)	Avast (Win32:Trojan-gen), BitDefender (Gen:Heur.Titirez.1.F), ESET-NOD32 (Win32/Spy.Agent.PQZ), Kaspersky (Trojan-Spy.MSIL.Stealer.aik), Full List (VirusTotal)
Malicious Process Name(s)	2.exe (the name may vary).
Symptoms	Trojans are designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine.
Distribution methods	Infected email attachments, malicious online advertisements, social engineering, software 'cracks'.
Damage	Stolen banking information, passwords, identity theft, victim's computer added to a botnet.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. ▼ Download Combo Cleaner To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Similarities with other information-stealing trojans

The internet is full of data-tracking trojans. For example, Banload, Bolik, Tofsee, Vidar, any many others. In most cases, however, developers of these infections do not provide stolen-data-access services as is the case with Raccoon Stealer's developers.

Typically, cyber criminals misuse recorded information and generate revenue by selling malicious executables so that buyers can infect other people's computers and gather data directly, without involving third parties.

In any case, the presence of such infections can lead to identical issues: significant financial loss, serious privacy issues, and identity theft. Eliminate all data-tracking trojans immediately.

How did Raccoon Stealer infiltrate my computer?

A known distribution tool used to spread Raccoon Stealer is Rig Exploit Kit (RigEK), which injects systems with the Smoke Loader trojan. This, in turn, downloads and injects Raccoon Stealer. There are, however, number of other tools/methods used to spread these trojans.

The list includes third party software download sources, spam email campaigns, fake software updaters and cracks, and other trojans (leading to chain infections). Cyber criminals use unofficial download sources (free file hosting websites, peer-to-peer [P2P] networks, freeware download websites, etc.) to proliferate malware by presenting it as legitimate software.

Users are tricked into manual download/installation of malware. Spam campaigns are also used in a similar manner. Cyber criminals send hundreds of thousands of identical emails containing malicious attachments (files/links) and deceptive messages.

The messages typically present the attachments as 'important documents' (bills, invoices, receipts or similar) in attempts to give the impression of legitimacy and trick users into opening them. The idea behind software cracks is to activate paid software free of charge, however, many of these tools are fake.

Rather than allowing access paid features, they simply inject malware into the system. Fake updaters are very similar. Rather than updating installed applications, these tools infect computers by exploiting outdated software bugs/flaws or simply downloading and installing malware rather than the updates.

Finally, trojans cause "chain infections". These malicious apps stealthily infiltrate computers and, while running in the background, download and install additional malware (usually, high-risk infections, such as other trojans). In summary, the main reasons for computer infections are lack of knowledge of these threats and careless behavior.

How to avoid installation of malware

To prevent this situation, be cautious when browsing the internet and downloading/installing/updating software. Carefully analyze all received email attachments. If the file/link is irrelevant, do not open anything. Attachments received from suspicious/unrecognizable email addresses should be ignored.

Download software from official sources only, using direct download links. Third party downloaders/installers are often used to proliferate malware, and thus these tools should be avoided. The same applies to software updates.

Keep installed apps and operating systems up-to-date, however, this should be achieved only through implemented functions or tools provided by the official developer. Software piracy is a cyber crime and the risk of infection is high. Therefore, never attempt to crack any applications.

The same applies to downloading software that is already cracked. Have a reputable anti-virus/anti-spyware suite installed and running.

These tools detect and eliminate malware before the system is harmed. The key to computer safety is caution. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Screenshots of Raccoon Stealer admin panel for subscribers:

Screenshot of a hacker forum used to promote Raccoon Stealer as a service:

Raccoon Stealer's detection names in various malware databases listed by VirusTotal:

Update April 7, 2020 - Cyber criminals using Raccoon Stealer have been observed implementing new techniques to evade detection. Following infection, the malware firstly connects to a Google Drive URL and initiates a chain to ensure data exfiltration to the criminals' C&C (command and control) server.

The cyber criminals are using Google Cloud Services to host some of their C&C servers, thereby disguising their traffic as legitimate and originating from Google. Additionally, Raccoon Stealer has been observed being proliferated via sextortion-themed spam campaign.

In these emails the malicious attachments are disguised as compromising material, allegedly obtained from one of the recipients' contacts. More information on said developments can be found in an article by Paul Pajares on blog.trendmicro.com. 

Screenshot of "Your friend’s account was compromised" email, used to proliferate Raccoon Stealer:

Text presented in this email:

Hi there, we're a Red Skull hacker group. We have got access to the mail account of one man, and you are in his contacts. In his mail, we have found photos of his naked wife and requested $500 for them. In case he'll ignore us, we guaranteed him that we would direct these photographs to everyone of his contacts. Unluckily, he hasn't paid, and since you have been on his mail, you received this msg. You will find these pix attached to this letter.

Update April 10, 2020 - Raccoon Stealer was observed being proliferated using a fake Malwarebytes website. This site is disguised as the official webpage of the Malwarebytes corporation, developers of anti-malware software of the same name. The fraudulent website uses part of the code from the legitimate site with some malicious additions.

The added JavaScript is designed to infer what browser the visitor is using and if it is Internet Explorer - a malicious URL is force-opened. This initiates the infiltration of Raccoon Stealer via Fallout exploit kit. More information on this new distribution technique can be found in an article by the Malwarebytes' Threat Intelligence Team on blog.malwarebytes.com.

Screenshot the fake Malwarebytes website, used to distribute Raccoon Stealer:

Screenshot of a deceptive website (private-virtual[.]online) promoting a fake VPN app installer which is actually the Raccoon Stealer spyware:

Example of a malicious MS Excel document (distributed via spam emails) designed to inject Raccoon Stealer malware into the system:

Another example of a malicious MS Excel doc designed to inject Raccoon Stealer:

An example of a malicious MS Word document used to spread Raccoon Stealer spyware:

Update July 4, 2022 - Raccoon Stealer was for sale until the end of March 2022. However, a second version (named "Raccoon Stealer V2" or "RecordBreaker"), including information about the release of this version, has been discovered recently. It steals passwords, cookies, autofill data, and credit card details from web browsers, data from cryptocurrency wallets, Telegram data. Also, it downloads and loads files.

Also, it can capture screenshots, get the list of installed applications, remove files created by it, and more. The second version sends collected data in a file to Command and Control server via a POST request. The new version is supposed to be more handy, useful, and efficient for cybercriminals who purchased it (and more dangerous for the victims). You can find more information regarding the update in our News article.

Screenshot of Raccon Stealer developer's post in a hacker forum confirming that the project is being revived:

Screenshot of a STARLINK-themed scam website (star-link[.]app) used to spread Raccoon Stealer malware:

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is Raccoon Stealer?
• STEP 1. Manual removal of Raccoon Stealer malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with Raccoon Stealer malware, should I format my storage device to get rid of it?

This malware can be eliminated without formatting the storage device. It can be removed by following the steps provided in our removal guide above.

What are the biggest issues that malware can cause?

Identity theft, monetary loss, data loss (encryption), loss of personal accounts (e.g., email, social media, banking accounts), and other issues.

What is the purpose of Raccoon Stealer?

Raccoon is an information stealer. It can steal sensitive data (saved passwords, autofill forms, credit card details, cookies) from web browsers and multiple cryptocurrency wallets. Also, it can make screenshots, download and load files, obtain system information, and more.

How did a malware infiltrate my computer?

It is known that cybercriminals have used fake installers, websites hosting cracked (pirated) software, and emails containing malicious attachments to trick users into executing the Raccoon Stealer. They also have used fake websites (masquerading as download pages for legitimate software), and the Rig Exploit Kit.

Will Combo Cleaner protect me from malware?

Yes, Combo Cleaner can detect and eliminate almost all known malware. It is important to use the full scan option to remove high-end malware. Otherwise, security software will not detect malware that hides deep in the operating system.

▼ Show Discussion