Trojan:Win32/Raccoon.DG!MTB

If you spectate the notification of Trojan:Win32/Raccoon.DG!MTB detection, it looks like that your system has a problem. All viruses are dangerous, with no deviations. Raccoon is a virus that targets on collecting different types of information from your PC. It practices a lot of tricks to avoid security software detection, and uses secured connections to exfiltrate data. The activity of this malware commonly ends up with losing access to your accounts, and compromising your identity. Moreover, some samples are also able to deliver other malicious programs to the system.

What does the pop-up with Trojan:Win32/Raccoon.DG!MTB detection mean?

The Trojan:Win32/Raccoon.DG!MTB detection you can see in the lower right side is shown to you by Microsoft Defender. That anti-malware program is good at scanning, however, prone to be basically unstable. It is unprotected to malware invasions, it has a glitchy interface and problematic malware clearing features. For this reason, the pop-up which says concerning the Raccoon is just a notification that Defender has actually found it. To remove it, you will likely need to use another anti-malware program.

Trojan:Win32/Raccoon.DG!MTB found

Microsoft Defender: “Trojan:Win32/Raccoon.DG!MTB”

Having Trojan:Win32/Raccoon.DG!MTB malware on your computer is not a pleasant thing from any perspective. The most troublesome issue is that you will barely see anything wrong. Key quality of any spyware is being as stealthy as possible. Some Raccoon samples also can perform self-removal after grabbing all the valuables available on the computer. Then, it will be almost impossible to uncover the flow of events and understand how your accounts were hacked. Long-residing variants of spyware can target the specific directory or file type. Files grabbed in such a way will be put for sale on the Darknet – at one of its numerous forums with leaked data.

Spyware Summary:

Name Raccoon Spyware
Detection Trojan:Win32/Raccoon.DG!MTB
Damage Steal personal data contained in the attacked system.
Similar Trojan:Win32/Raccoon.N!MTB, Trojan:Win32/Raccoon.MD!MTB
Fix Tool See If Your System Has Been Affected by Raccoon Spyware

Raccoon.DG!MTB Technical Description

Malware Behaviour
Click to expand
  • SetUnhandledExceptionFilter detected (possible anti-debug);
  • Behavioural detection: Executable code extraction – unpacking;
  • Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution;
  • Yara rule detections observed from a process memory dump/dropped files/CAPE;
  • Creates RWX memory;
  • Dynamic (imported) function loading detected;
  • Reads data out of its own binary image;
  • A process created a hidden window;
  • CAPE extracted potentially suspicious content;
  • Unconventionial language used in binary resources: Spanish (Argentina);
  • The binary contains an unknown PE section name indicative of packing;
  • Authenticode signature is invalid;
  • Uses Windows utilities for basic functionality;
  • Enumerates services, possibly for anti-virtualization;
  • Installs itself for autorun at Windows startup;
  • Installs itself for autorun at Windows startup;
  • CAPE detected the Tofsee malware family;
  • Created a service that was not started;
  • Anomalous binary characteristics;
  • Uses suspicious command line tools or Windows utilities;
Alternative detection names
Click to expand
Bkav W32.AIDetect.malware1
Lionic Trojan.Win32.Malicious.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
FireEye Generic.mg.9dad2d6727f92262
McAfee Artemis!9DAD2D6727F9
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Ransom:Win32/Kryptik.9191261a
K7GW Trojan ( 0058cc8f1 )
K7AntiVirus Trojan ( 0058cc8f1 )
Cyren W32/Kryptik.FWV.gen!Eldorado
Symantec Packed.Generic.525
ESET-NOD32 a variant of Win32/Kryptik.HNXY
APEX Malicious
ClamAV Win.Dropper.Tofsee-9919472-0
Kaspersky HEUR:Trojan-Ransom.Win32.Stop.gen
BitDefender Gen:Variant.Jaik.50051
MicroWorld-eScan Gen:Variant.Jaik.50051
Avast Win32:Malware-gen
Tencent Win32.Trojan.Kryptik.Hxgn
Ad-Aware Gen:Variant.Jaik.50051
Emsisoft Gen:Variant.Jaik.50051 (B)
DrWeb Trojan.Siggen16.29302
TrendMicro Mal_Tofsee
McAfee-GW-Edition BehavesLike.Win32.Generic.vh
Sophos ML/PE-A + Mal/Agent-AWV
Ikarus Trojan.Win32.Crypt
GData Win32.Trojan.BSE.D5WJT
Avira TR/Crypt.EPACK.Gen2
Microsoft Trojan:Win32/Raccoon.DG!MTB
AhnLab-V3 Infostealer/Win.SmokeLoader.R463373
Acronis suspicious
BitDefenderTheta Gen:NN.ZexaF.34114.@xW@a0N4SwRe
MAX malware (ai score=84)
VBA32 BScope.Trojan.Convagent
Malwarebytes Trojan.MalPack.GS
TrendMicro-HouseCall Mal_Tofsee
Rising Malware.Heuristic!ET#90% (RDMK:cmRtazrAqGMP4gzB/J0TZpoxLcrG)
SentinelOne Static AI – Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.ERHN!tr
AVG Win32:Malware-gen
Panda Trj/GdSda.A

Is Trojan:Win32/Raccoon.DG!MTB dangerous?

As I said before, any malware is dangerous. And Trojan:Win32/Raccoon.DG!MTB is not even close to making more disturbance than real damage. The most deceptive feature of Raccoon is the fact you cannot spectate its activity by any means, other than with anti-malware software scanning. And while you are having no clue, cybercriminals who implemented their malware to your system are starting to count the money. Darknet forums offer a lot of opportunities to sell malware logs for a large sum – especially when these logs are new. And it is a bad idea to imagine what will happen to your accounts when other crooks will put their hands on your credentials.

However, things may have way faster flow. In some situations, hackers are delivering their virus precisely to the person they are going to rob. Spyware is priceless when it comes to grabbing login credentials, and some examples aim precisely at online banking accounts or cryprocurrency wallets. One may say, giving spyware a run equals to sending all your money to criminals.

How did I get this virus?

It is hard to trace the sources of malware on your computer. Nowadays, things are mixed, and spreading ways chosen by adware 5 years ago may be utilized by spyware nowadays. But if we abstract from the exact spreading tactic and will think about why it works, the explanation will be very simple – low level of cybersecurity awareness. People click on advertisements on strange websites, click the pop-ups they get in their browsers, call the “Microsoft tech support” assuming that the weird banner that says about malware is true. It is essential to recognize what is legitimate – to stay away from misconceptions when trying to determine a virus.

Microsoft tech support scam

The example of Microsoft Tech support scam banner

Nowadays, there are two of the most common ways of malware spreading – bait e-mails and injection into a hacked program. While the first one is not so easy to avoid – you need to know a lot to recognize a fake – the second one is simple to get rid of: just don’t use hacked programs. Torrent-trackers and various other sources of “totally free” applications (which are, exactly, paid, but with a disabled license checking) are just a giveaway point of malware. And Trojan:Win32/Raccoon.DG!MTB is simply among them.

How to remove the Trojan:Win32/Raccoon.DG!MTB from my PC?

References

    About the author

    Robert Bailey

    Security engineer focused on malware behavior, removal workflows, and Windows hardening. Robert reviews threat articles for practical accuracy, checking detection names, symptoms, and cleanup steps before publication.

    Leave a Comment