Raccoon Stealer v2 and the Excel add-in delivery trick

by psyrun / 2023-02-06 / Stealer

Raccoon is an information stealer sold as a service since 2019. It went quiet in March 2022 and returned in June of that year as version 2.

Version 2 internals

  • Strings and the command-and-control URL go through the same decryption loop, and an RC4 key is stored in plain text in the binary.
  • A mutex with a fixed numeric name is created.
  • The user's locale is checked and the malware exits for Russian systems.
  • Before anything is stolen it sends the machine ID, user name and a configuration ID to the server.
  • It then downloads support libraries through WinInet.
  • Newer samples use three distinctive User-Agent strings: one for the first POST, one for the library download and one for exfiltration.

The 2023 Excel add-in campaign

spam mail  ->  link to a bank-themed page proxied through a translation service
                  -> Excel add-in (.xll) download
                       -> user opens it; xlAutoOpen runs
                            -> a bundled wget.exe is written to %TEMP%
                                 -> downloads a zip with the Raccoon executable
                                      -> executable contacts C2, fetches libraries, sends data

An XLL file is simply a DLL that Excel loads, so you can run it manually under rundll32 with the xlAutoOpen export to watch it execute.

Server-side fingerprints

The panel page used to answer with the HTTP title "Raccoon Stealer 2.0", its TLS certificate named a Raccoon domain, and script code contained contact details for the sellers on Jabber and Telegram. Those fingerprints help find more of the infrastructure.

Check list

  • Excel spawning a download of an archive from an unusual IP.
  • A process with all three odd numeric User-Agents.
  • DLL downloads from a C2 immediately after the first POST.