Raccine Uses Windows IFEO Debuggers to Disrupt Ransomware Activity
Summary
Huntress analysts found Raccine, an open-source utility that uses Windows IFEO debuggers and YARA rules to block ransomware-related commands. It can be deployed through Group Policy, but may also block legitimate activity.
Key points
- Huntress analysts encountered Raccine configured as an Image File Execution Options (IFEO) debugger for native Windows programs.
- Raccine is an open-source utility developed by security researcher Florian Roth.
- The tool monitors for ransomware-related activity, such as attempts to delete shadow copies, and can stop the command and its running parent processes.
- Raccine uses adjustable YARA rules to identify unsafe command combinations involving tools such as diskshadow, wbadmin, PowerShell, and bcdedit.
- It can be installed with a batch script or deployed through Group Policy, and records information in a log file and Windows Event Log.
- The article warns that Raccine may block legitimate manual commands or backup processes, and that some malware families attempt to remove or bypass it.
Article Details
- Topic
- Raccine, an open-source ransomware protection utility that uses Image File Execution Options debuggers to block ransomware activity.
MITRE ATT&CK
T1490 · Inhibit System RecoveryThe article describes ransomware deleting shadow copies using native Windows utilities, behavior Raccine is designed to detect and block.T1546.012 · Image File Execution Options InjectionRaccine uses Image File Execution Options (IFEO) debugger registration as a defensive mechanism; the article describes the technique as abusable for launching malicious code.
People
Malware
Emotetand fine-tuned to one’s needs, but the repository goes on to showcase how this can stop the infection of Emotet, RagnarLocker, Ryuk and more. It looks for malicious combinations of diskshadow, wbadmin, powershell andRagnarLockerto one’s needs, but the repository goes on to showcase how this can stop the infection of Emotet, RagnarLocker, Ryuk and more. It looks for malicious combinations of diskshadow, wbadmin, powershell and bcdedit,Ryukneeds, but the repository goes on to showcase how this can stop the infection of Emotet, RagnarLocker, Ryuk and more. It looks for malicious combinations of diskshadow, wbadmin, powershell and bcdedit, just as we
Products
HuntressWithin the ThreatOps department at Huntress, we actively hunt for malware and adversary activity. We look for persistent footholds: the tell-tale sign and smoking gun at the crime scene that truly indicates there isRaccinebut sometimes a static and defined name is just as interesting. This foothold caught our eye: “What is raccine.exe?” Could that be some clever name for a RAT (remote access Trojan)?
Tools
foremostWe also saw an IHDR PNG file header in the strings output, so we ran foremost to carve out other files.YARARaccine uses YARA rules that can be adjusted and fine-tuned to one’s needs, but the repository goes on to showcase how this can stop the infection of Emotet, RagnarLocker, Ryuk and more. It looks for malicious