Written by Robert Bailey
If you spectate the notification of Trojan:Win32/Raccoon.DG!MTB detection, it looks like that your system has a problem. All viruses are dangerous, with no deviations. Raccoon is a virus that targets on collecting different types of information from your PC. It practices a lot of tricks to avoid security software detection, and uses secured connections to exfiltrate data. The activity of this malware commonly ends up with losing access to your accounts, and compromising your identity. Moreover, some samples are also able to deliver other malicious programs to the system.
GridinSoft Anti-Malware Review
It is better to prevent, than repair and repent!
When we talk about the intrusion of unfamiliar programs into your computer’s work, the proverb “Forewarned is forearmed” describes the situation as accurately as possible. Gridinsoft Anti-Malware is exactly the tool that is always useful to have in your armory: fast, efficient, up-to-date. It is appropriate to use it as an emergency help at the slightest suspicion of infection.
Gridinsoft Anti-Malware 6-day trial available.
EULA | Privacy Policy | 10% Off Coupon
Subscribe to our Telegram channel to be the first to know about news and our exclusive materials on information security.

Any kind of malware exists with the only target – make money on you1. And the programmers of these things are not thinking about morality – they use all available ways. Stealing your personal data, receiving the payments for the advertisements you watch for them, exploiting your system to mine cryptocurrencies – that is not the complete list of what they do. Do you want to be a riding horse? That is a rhetorical question.

What does the pop-up with Trojan:Win32/Raccoon.DG!MTB detection mean?

The Trojan:Win32/Raccoon.DG!MTB detection you can see in the lower right side is shown to you by Microsoft Defender. That anti-malware program is good at scanning, however, prone to be basically unstable. It is unprotected to malware invasions, it has a glitchy interface and problematic malware clearing features. For this reason, the pop-up which says concerning the Raccoon is just a notification that Defender has actually found it. To remove it, you will likely need to use another anti-malware program.

Trojan:Win32/Raccoon.DG!MTB found

Microsoft Defender: “Trojan:Win32/Raccoon.DG!MTB”

Having Trojan:Win32/Raccoon.DG!MTB malware on your computer is not a pleasant thing from any perspective. The most troublesome issue is that you will barely see anything wrong. Key quality of any spyware is being as stealthy as possible. Some Raccoon samples also can perform self-removal after grabbing all the valuables available on the computer. Then, it will be almost impossible to uncover the flow of events and understand how your accounts were hacked. Long-residing variants of spyware can target the specific directory or file type. Files grabbed in such a way will be put for sale on the Darknet – at one of its numerous forums with leaked data.

Spyware Summary:

NameRaccoon Spyware
DamageSteal personal data contained in the attacked system.
SimilarTrojan:Win32/Raccoon.N!MTB, Trojan:Win32/Raccoon.MD!MTB
Fix ToolSee If Your System Has Been Affected by Raccoon Spyware

Raccoon.DG!MTB Technical Description

Malware Behaviour
Click to expand
  • SetUnhandledExceptionFilter detected (possible anti-debug);
  • Behavioural detection: Executable code extraction – unpacking;
  • Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution;
  • Yara rule detections observed from a process memory dump/dropped files/CAPE;
  • Creates RWX memory;
  • Dynamic (imported) function loading detected;
  • Reads data out of its own binary image;
  • A process created a hidden window;
  • CAPE extracted potentially suspicious content;
  • Unconventionial language used in binary resources: Spanish (Argentina);
  • The binary contains an unknown PE section name indicative of packing;
  • Authenticode signature is invalid;
  • Uses Windows utilities for basic functionality;
  • Enumerates services, possibly for anti-virtualization;
  • Installs itself for autorun at Windows startup;
  • Installs itself for autorun at Windows startup;
  • CAPE detected the Tofsee malware family;
  • Created a service that was not started;
  • Anomalous binary characteristics;
  • Uses suspicious command line tools or Windows utilities;
Alternative detection names
Click to expand
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
CrowdStrikewin/malicious_confidence_100% (W)
K7GWTrojan ( 0058cc8f1 )
K7AntiVirusTrojan ( 0058cc8f1 )
ESET-NOD32a variant of Win32/Kryptik.HNXY
EmsisoftGen:Variant.Jaik.50051 (B)
SophosML/PE-A + Mal/Agent-AWV
MAXmalware (ai score=84)
RisingMalware.Heuristic!ET#90% (RDMK:cmRtazrAqGMP4gzB/J0TZpoxLcrG)
SentinelOneStatic AI – Malicious PE

Is Trojan:Win32/Raccoon.DG!MTB dangerous?

As I said before, any malware is dangerous. And Trojan:Win32/Raccoon.DG!MTB is not even close to making more disturbance than real damage. The most deceptive feature of Raccoon is the fact you cannot spectate its activity by any means, other than with anti-malware software scanning. And while you are having no clue, cybercriminals who implemented their malware to your system are starting to count the money. Darknet forums offer a lot of opportunities to sell malware logs for a large sum – especially when these logs are new. And it is a bad idea to imagine what will happen to your accounts when other crooks will put their hands on your credentials.

However, things may have way faster flow. In some situations, hackers are delivering their virus precisely to the person they are going to rob. Spyware is priceless when it comes to grabbing login credentials, and some examples aim precisely at online banking accounts or cryprocurrency wallets. One may say, giving spyware a run equals to sending all your money to criminals.

How did I get this virus?

It is hard to trace the sources of malware on your computer. Nowadays, things are mixed, and spreading ways chosen by adware 5 years ago may be utilized by spyware nowadays. But if we abstract from the exact spreading tactic and will think about why it works, the explanation will be very simple – low level of cybersecurity awareness. People click on advertisements on strange websites, click the pop-ups they get in their browsers, call the “Microsoft tech support” assuming that the weird banner that says about malware is true. It is essential to recognize what is legitimate – to stay away from misconceptions when trying to determine a virus.

Microsoft tech support scam

The example of Microsoft Tech support scam banner

Nowadays, there are two of the most common ways of malware spreading – bait e-mails and injection into a hacked program. While the first one is not so easy to avoid – you need to know a lot to recognize a fake – the second one is simple to get rid of: just don’t use hacked programs. Torrent-trackers and various other sources of “totally free” applications (which are, exactly, paid, but with a disabled license checking) are just a giveaway point of malware. And Trojan:Win32/Raccoon.DG!MTB is simply among them.

How to remove the Trojan:Win32/Raccoon.DG!MTB from my PC?

Trojan:Win32/Raccoon.DG!MTB malware is very hard to erase by hand. It stores its documents in several places throughout the disk, and can get back itself from one of the parts. In addition, various modifications in the registry, networking configurations and also Group Policies are really hard to discover and return to the initial. It is better to utilize a specific tool – exactly, an anti-malware program. GridinSoft Anti-Malware will fit the best for malware removal objectives.

Why GridinSoft Anti-Malware? It is very light-weight and has its detection databases updated just about every hour. Furthermore, it does not have such problems and vulnerabilities as Microsoft Defender does. The combination of these facts makes GridinSoft Anti-Malware ideal for getting rid of malware of any kind.

Remove the viruses with GridinSoft Anti-Malware

  • Download and install GridinSoft Anti-Malware. After the installation, you will be offered to perform the Standard Scan. Approve this action.
  • Gridinsoft Anti-Malware during the scan process

  • Standard scan checks the logical disk where the system files are stored, together with the files of programs you have already installed. The scan lasts up to 6 minutes.
  • GridinSoft Anti-Malware scan results

  • When the scan is over, you may choose the action for each detected virus. For all files of Raccoon the default option is “Delete”. Press “Apply” to finish the malware removal.
  • GridinSoft Anti-Malware - After Cleaning
User Review
0 (0 votes)
Comments Rating 0 (0 reviews)


  1. Read about malware types on GridinSoft Threat encyclopedia.

About the author

Robert Bailey

I'm Robert Bailey, a passionate Security Engineer with a deep fascination for all things related to malware, reverse engineering, and white hat ethical hacking.

As a white hat hacker, I firmly believe in the power of ethical hacking to bolster security measures. By identifying vulnerabilities and providing solutions, I contribute to the proactive defense of digital infrastructures.

Leave a Reply