Recordbreaker: The Resurgence of Raccoon

This report provides a technical analysis of Raccoon Stealer v2, an actively observed information‑stealer offered as malware‑as‑a‑service: it documents the packer’s anti‑analysis and anti‑debugging techniques (RDTSC, thread suspension, NT API hooking), runtime behaviors (dynamic API/DLL loading, XOR string decoding, locale/mutex/admin checks), C2 profile and module identifiers controlling features (browser and wallet theft, screenshots, file grabbing, additional payload execution), targeted data sources (Chrome/Firefox databases, many crypto wallets and extensions, Telegram/Discord), and includes IoCs (sample hashes and an IP).