MVISION Insights: Threat Profile: Predator the Thief
Technical Articles ID:
KB95210
Last Modified: 1/21/2022
Last Modified: 1/21/2022
Environment
IMPORTANT: This Knowledge Base article discusses a specific threat that is being automatically tracked by MVISION Insights technology. The content is intended for use by MVISION Insights users, but is provided for general knowledge to all customers. Contact us for more information about MVISION Insights.
Summary
Predator the Thief is a feature-rich information stealer. It is sold on hacking forums as a bundle which includes a payload builder and Command and Control web panel. It can grab passwords from browsers, replace cryptocurrency wallets, and take photos from web-cameras. It is developed by using a modular approach so that criminals may add more sophisticated tools on top of it.
The actor jonexl was selling Predator the Thief on numerous underground forums. According to jonexl's advertisement, Predator the Thief has the following functionalities:
NOTE: This text is auto translated from Russian.
Predator The Thief is a non-resident, native stealer written in C ++.
Executable file weight: ~ 420 (~ 200kb under UPX). Stiller works only in memory (the log is not dropped to disk), all data is encrypted, one backup domain. Stiller does not work with CIS bots.
Stiller functionality:
Recursively collect passwords, cookies, history, credit cards, auto-complete forms from Chromium-Based browsers:
Google Chrome, Chromium, Opera, Amigo, Torch, Orbitum, Kometa, Comodo Dragon, Nichrome, Maxthon5, Sputnik, Epic Privacy Browser, Vivaldi, CocCoc and others based on Chromium.
Recursive collection of passwords, cookies, history, auto-complete forms from Gecko-Based browsers:
Mozilla Firefox, Waterfox, Cyberfox, Pale Moon, BlackHawk, IceCat, K-Meleon and others based on Gecko.
Collecting passwords, cookies from Edge
Collection of Windows Cookies *
Getting a screenshot of the desktop *
Receiving an image from a webcam *
Collecting data for authorization FileZilla, WinFTP, WinSCP
Session collection Discord *, Steam *, Telegram *, osu !, Authy
Collecting Skype dialogs *
Collecting data for authorization NordVPN
Collecting data for Pidgin authorization
Collecting data for Outlook authorization (collection from all profiles and most versions)
Collecting Battle Net Account Information
Recursive collection of wallet.dat + 7 Built-in cold wallets: Electrum, MultiBit, Ethereum, Jaxx, ByteCoin, Atomic, Exodus
Collecting information about the PC: Username, PC name, OS version, OS bit depth, text from the clipboard, the directory from which the build is launched, GPU, CPU, RAM, screen extension, list of PC users, installed software and its versions, city, country, time zone, postal code, coordinates
Anti-VM * - the stealer will not knock from virtual machines
Self-removal *
Builds are issued in two formats: .exe, .dll
Both versions work from under Low IL
* - Functions that can be turned on /off in the stealer panel:
Functionality:
Online viewing of logs
Log statistics
Filters and sorting of logs
Backup of logs - you can download all logs at once, or only selected ones by one archive
Panel customization
Anti-dos gate settings
A telegram bot built into the panel that will send notifications about new logs (disabled by default)
Online setup of grabber and config
Domain Detect (analogue of presets in other software, Real-time update)
Converting cookies from NetScape to Json
User system - create users, send them logs
Public statistics for the uploader
Percentage statistics by country
Ability to upload duplicates
2FA authorization via telegram bot
Passwords List for each log
Search for passwords of 2 types (the ability to download a file or copy to a buffer)
Modules:
Loader: Free. There are 4 types of launches, settings for: bit depth, countries, crypto wallets, and passwords. Available exit from Low to High IL (runas)
I do not sell a lease, but a full-fledged one (your build for any domain that you yourself will make + control panel)
After purchase, you get everything you need + (setting up for your host is free, at my discretion, if I'm not busy)
Initial price: $ 200
To pay accept: BTC, Webmoney
The McAfee Enterprise Advanced Threat Research team will continue to monitor and update the Predator The Thief event and disseminate information that is deemed appropriate regarding Predator the Thief and any potential victims.
How to use this article:
- If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign.
- Review the product detection table and confirm that your environment is at least on the specified content version.
To download the latest content versions, go to the Security Updates page. - Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
- Review
KB91836 - Countermeasures for entry vector threats . - Review KB87843 - Dynamic Application Containment rules and best practices.
- Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.
This Knowledge Base article discusses a specific threat that is being tracked. The list of IOCs will change over time; check MVISION Insights for the latest IOCs.
Campaign IOC
| Type | Value |
| SHA256 | 84F6FD5103BFA97B8479AF5A6DB82100149167690502BB0231E6832FC463AF13 |
| SHA256 | 4245088E2600188006929BC88F455B57E849EF1748C0BDA3E9BD3C4DD23AE017 |
| SHA256 | 6F4A532FCCC9A0C4692ADAFCFBD17B74DA04804A97F5027AA86853B523556110 |
| SHA256 | 352F427D7083D64397D5C2A1C583A04DCEBA2D766A56A3A663592AB1942A87B5 |
| SHA256 | E1617D2D6174A5C5DFD98D92F238D5F8ECBB8EF5071937FBBFC413CE6B0A5114 |
| SHA256 | B930DFF913CF9E3F04AB0081E0F5FCACD77A4FA3E1A23C488A56D25FFFA5D18E |
| SHA256 | D5A20368B97C56CF908136316E979D5934A3731CB88C8F62EB8F83421C78C33E |
| SHA256 | FF48FABBFAB6EABBCDA54AC752AAC9B681253DA1CF3C9EE8EE4A0C1B224147B7 |
| SHA256 | 4AAF32A9593E3FFF90D2FC26E766549D044D89D8A473534C94C94925B1678DAD |
| SHA256 | 67560747A165C495A3DDDFF9095F5AACFD2E64AD5451783C1EE424F512E3BB86 |
| SHA256 | A4A441DE8AE429F62DD78B82557D5C56732E2D716D62E403427E8CFF4DEF2DFE |
| SHA256 | 1145B9BCBAF5236A71A48B403BF929FA236B798D99947B0C59F8F4891A75D778 |
| SHA256 | F1DC32D9D1065E929BEA07B26B09210056271A74DCF0E6B4E2D9705590B3753E |
| SHA256 | D0070C9D05DB769DEEF14D8DBC44E1FA2D9DA0C8DA3203499AE63A25340BA3A1 |
| SHA256 | 0B74E3AE6E3FB13A47FBF576E82D87C82E77B58D94355A8FB249FCD2F8A6D1C2 |
| SHA256 | 3487E3F25EB4CD19DC8F2BD024538131A2A0594E05E8E2BDEDEEBB5BB6073B4E |
| SHA256 | 4987DF71C6169F91852CE4F8678EC18FCE8E22ACF12AB6DCFF1C936F0A01421E |
| SHA256 | FFB99BB263054241D6D3C9330EA911A3B596B3F0D1146CD5C09DF2652A3A8DA8 |
| SHA256 | 5A917EFEFA5936C1931158D7061E428BDF412112823DE5D24AB8546B8C4F2877 |
| SHA256 | 7A0831666570DAF4E684EFB6330AD50B6B792D6515D2CBE2976B39A568FED340 |
| SHA256 | 88B50A4994B7914C407D51FB57B580B3C9944C6BDCE26448918446F5D132AF69 |
Minimum Content Versions:
| Content Type | Version |
| V2 DAT (VirusScan Enterprise) | 10169 |
| V3 DAT (Endpoint Security) | 4621 |
Detection Summary
| IOC | Scanner | Detection |
| 84F6FD5103BFA97B8479AF5A6DB82100149167690502BB0231E6832FC463AF13 | AVEngine V2 | Lockbit-FSUC!6ECE85DF70B7 |
| AVEngine V3 | Lockbit-FSUC!6ECE85DF70B7 | |
| JTI (ATP Rules) | JTI/Suspect.196612!6ece85df70b7 | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| 4245088E2600188006929BC88F455B57E849EF1748C0BDA3E9BD3C4DD23AE017 | AVEngine V2 | GenericRXLW-UE!04A983EB92BA |
| AVEngine V3 | GenericRXLW-UE!04A983EB92BA | |
| JTI (ATP Rules) | JTI/Suspect.196612!04a983eb92ba | |
| RP Static | Real Protect-PENG4!04A983EB92BA | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| 6F4A532FCCC9A0C4692ADAFCFBD17B74DA04804A97F5027AA86853B523556110 | AVEngine V2 | GenericRXNB-QI!1F0C5319D2AD |
| AVEngine V3 | GenericRXNB-QI!1F0C5319D2AD | |
| JTI (ATP Rules) | JTI/Suspect.196612!1f0c5319d2ad | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| 352F427D7083D64397D5C2A1C583A04DCEBA2D766A56A3A663592AB1942A87B5 | AVEngine V2 | Generictrojan.mb |
| AVEngine V3 | Generictrojan.mb | |
| JTI (ATP Rules) | JTI/Suspect.196612!7d1b99352551 | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| E1617D2D6174A5C5DFD98D92F238D5F8ECBB8EF5071937FBBFC413CE6B0A5114 | AVEngine V2 | X97M/Downloader!F50F08AC332F |
| AVEngine V3 | X97M/Downloader!F50F08AC332F | |
| JTI (ATP Rules) | - | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| B930DFF913CF9E3F04AB0081E0F5FCACD77A4FA3E1A23C488A56D25FFFA5D18E | AVEngine V2 | Downloader-FYE!1B663E1FE2C8 |
| AVEngine V3 | Downloader-FYE!1B663E1FE2C8 | |
| JTI (ATP Rules) | JTI/Suspect.196612!1b663e1fe2c8 | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| D5A20368B97C56CF908136316E979D5934A3731CB88C8F62EB8F83421C78C33E | AVEngine V2 | Trojan-FUBK!1D87A442376B |
| AVEngine V3 | Trojan-FUBK!1D87A442376B | |
| JTI (ATP Rules) | JTI/Suspect.196612!1d87a442376b | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| FF48FABBFAB6EABBCDA54AC752AAC9B681253DA1CF3C9EE8EE4A0C1B224147B7 | AVEngine V2 | Trojan-FUBK!41F4A2A0F664 |
| AVEngine V3 | Trojan-FUBK!41F4A2A0F664 | |
| JTI (ATP Rules) | JTI/Suspect.196612!41f4a2a0f664 | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| 4AAF32A9593E3FFF90D2FC26E766549D044D89D8A473534C94C94925B1678DAD | AVEngine V2 | Lockbit-FSUC!AEFBC18D2B63 |
| AVEngine V3 | Lockbit-FSUC!AEFBC18D2B63 | |
| JTI (ATP Rules) | JTI/Suspect.196612!6ece85df70b7 | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| 67560747A165C495A3DDDFF9095F5AACFD2E64AD5451783C1EE424F512E3BB86 | AVEngine V2 | Trojan-FUBK!99E99C2E77B4 |
| AVEngine V3 | Trojan-FUBK!99E99C2E77B4 | |
| JTI (ATP Rules) | JTI/Suspect.196612!99e99c2e77b4 | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| A4A441DE8AE429F62DD78B82557D5C56732E2D716D62E403427E8CFF4DEF2DFE | AVEngine V2 | Trojan-FUBK!C4959D2F17E0 |
| AVEngine V3 | Trojan-FUBK!C4959D2F17E0 | |
| JTI (ATP Rules) | JTI/Suspect.196612!c4959d2f17e0 | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| 1145B9BCBAF5236A71A48B403BF929FA236B798D99947B0C59F8F4891A75D778 | AVEngine V2 | GenericRXNB-QI!FBE8499A4D3A |
| AVEngine V3 | GenericRXNB-QI!FBE8499A4D3A | |
| JTI (ATP Rules) | JTI/Suspect.196612!fbe8499a4d3a | |
| RP Static | Real Protect-PENG4!FBE8499A4D3A | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| F1DC32D9D1065E929BEA07B26B09210056271A74DCF0E6B4E2D9705590B3753E | AVEngine V2 | Lockbit-GCZ!EFD7AAF116A4 |
| AVEngine V3 | Lockbit-GCZ!EFD7AAF116A4 | |
| JTI (ATP Rules) | JTI/Suspect.196612!efd7aaf116a4 | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| D0070C9D05DB769DEEF14D8DBC44E1FA2D9DA0C8DA3203499AE63A25340BA3A1 | AVEngine V2 | Trojan-FUBK!55216ACBCBAC |
| AVEngine V3 | Trojan-FUBK!55216ACBCBAC | |
| JTI (ATP Rules) | JTI/Suspect.196612!55216acbcbac | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| 0B74E3AE6E3FB13A47FBF576E82D87C82E77B58D94355A8FB249FCD2F8A6D1C2 | AVEngine V2 | Trojan-FUBK!247544873720 |
| AVEngine V3 | Trojan-FUBK!247544873720 | |
| JTI (ATP Rules) | JTI/Suspect.196612!247544873720 | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| 3487E3F25EB4CD19DC8F2BD024538131A2A0594E05E8E2BDEDEEBB5BB6073B4E | AVEngine V2 | Trojan-FUBK!685B3AF4382F |
| AVEngine V3 | Trojan-FUBK!685B3AF4382F | |
| JTI (ATP Rules) | JTI/Suspect.196612!685b3af4382f | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| 4987DF71C6169F91852CE4F8678EC18FCE8E22ACF12AB6DCFF1C936F0A01421E | AVEngine V2 | Trojan-FUBK!F8E127A42E69 |
| AVEngine V3 | Trojan-FUBK!F8E127A42E69 | |
| JTI (ATP Rules) | JTI/Suspect.196612!f8e127a42e69 | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| FFB99BB263054241D6D3C9330EA911A3B596B3F0D1146CD5C09DF2652A3A8DA8 | AVEngine V2 | Trojan-FUBK!E3CEC06B6C21 |
| AVEngine V3 | Trojan-FUBK!E3CEC06B6C21 | |
| JTI (ATP Rules) | JTI/Suspect.196612!e3cec06b6c21 | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| 5A917EFEFA5936C1931158D7061E428BDF412112823DE5D24AB8546B8C4F2877 | AVEngine V2 | GenericRXLT-JQ!21F8A08971EA |
| AVEngine V3 | GenericRXLT-JQ!21F8A08971EA | |
| JTI (ATP Rules) | JTI/Suspect.196612!21f8a08971ea | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| 7A0831666570DAF4E684EFB6330AD50B6B792D6515D2CBE2976B39A568FED340 | AVEngine V2 | Packed-GDT!D6BA86E1AD45 |
| AVEngine V3 | Packed-GDT!D6BA86E1AD45 | |
| JTI (ATP Rules) | JTI/Suspect.196612!d6ba86e1ad45 | |
| RP Static | - | |
| RP Dynamic | - |
| IOC | Scanner | Detection |
| 88B50A4994B7914C407D51FB57B580B3C9944C6BDCE26448918446F5D132AF69 | AVEngine V2 | GenericRXNB-QI!D8148152E824 |
| AVEngine V3 | GenericRXNB-QI!D8148152E824 | |
| JTI (ATP Rules) | JTI/Suspect.196612!d8148152e824 | |
| RP Static | - | |
| RP Dynamic | - |
Minimum set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.
When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.
For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.
Endpoint Security - Advanced Threat Protection:
Rule ID: 4 Use GTI file reputation to identify trusted or malicious files
Endpoint Security - Exploit Prevention:
Rule ID: 6135 Unmanaged Powershell Detected
Host Intrusion Prevention:
Rule ID: 6135 Unmanaged Powershell Detected
Aggressive set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.
When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.
For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.
Virusscan Enterprise - Access Protection Rules:
Prevent creation of new executable files in the Windows folder
Host Intrusion Prevention:
Rule ID: 1020 Windows Agent Shielding - File Access
Rule ID: 2806 Attempt to create a hardlink to a file
Rule ID: 6010 Generic Application Hooking Protection
Rule ID: 6011 Generic Application Invocation Protection
