Type<\/strong>: Trojan<\/p>\n Degree of destruction<\/strong>: high<\/p>\n Prevalence<\/strong>: average<\/p>\n Trojans are malware that revealed themselves in the format of an applicable and useful tool. Accordingly, the user downloads and installs them and infects the system without noticing that it is malware. Trojans, usually after installation, act as a backdoor so the hacker can remotely access the victim’s system. For instance, the malware we will analyze here seems to do an applicable and useful job, but it will install an unwanted application on the system.<\/span><\/p>\n Racealer or Raccoon stealer is malware that aims to steal information such as crypto-currency wallet on the system, browser data, and email will attempt to infect the victim\u2019s system.<\/p>\n Introduction of the function:<\/strong><\/p>\n The goal of this malware is to steal information from the system and it\u2019s not looking for permanence on the system; as a result, it will not stay in the system and has no considerable impact. Stolen information by this malware is stored information in browsers, clients\u2019 emails, and crypto-currency wallets. This malware uses Google services such as google drive to connect with the command and control server and find its IP. First, a part of its header will find its command and control server IP, by sending a request to a link in google drive and decrypting it, which usually, this server is behind google services. For hiding and not being detected, it will immediately change these links and IPs for being different for every attack. Then it will send general information about victims such as botID and system information to the attained IP in the gate\/log.php path. Then it will receive the necessary files to extract information from the system such as browsers, by connecting to gate\/sqlite3.dll and gate\/libs.zip addresses. In the end, it will send the stolen information to hxxp:\/\/C&C_IP\/file_handler\/file.php. Usually, the distribution method of this malware is post-exploitation type, for instance, attackers run this malware in the victim\u2019s system by using exploit kits and existent vulnerabilities in browsers. Additionally, in some cases, they will distribute malware by phishing or social engineering.<\/p>\n Stolen information by Racealer malware:<\/strong><\/p>\nWhat is a Trojan?<\/h3>\n
What is Racealer malware?<\/h3>\n
Technical Explanation<\/h2>\n
Signs of infection<\/h3>\n
\n
hxxps:\/\/drive[.]google[.]com\/uc?export=download&id=\u2026<\/code><\/p>\n\n
hxxp:\/\/C&C_IP\/gate\/log.php<\/code><\/p>\n\n
hxxp:\/\/C&C_IP\/file_handler\/file.php<\/code><\/p>\n\n
How to deal with it and disinfect the system<\/h2>\n