Malware
Agent Racoon
Agent Racoon is a .NET-based backdoor malware that leverages DNS for covert C2 communication, employing randomized subdomains and Punycode encoding to evade detection.
Agent Racoon is a Windows malware family.
Background
Agent Racoon is a backdoor built on .NET that hides its C2 traffic inside DNS, using randomized subdomains together with Punycode encoding to slip past detection. Communications are encrypted with a key unique to each sample, and the backdoor can run remote commands and move files. It has no built-in persistence, instead depending on external mechanisms such as scheduled tasks to keep running. Operating since at least 2020, the malware has struck organizations across the U.S., the Middle East, and Africa, spanning non-profit and government entities. To stay hidden, it masquerades as trusted binaries like Google Update and MS OneDrive Updater and applies obfuscation tactics including Base64 encoding and altered timestamps.
Source: Malpedia (Fraunhofer FKIE).