{ "type": "bundle", "id": "bundle--5e04e696-4e74-4be0-a8e1-4cee02de0b81", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:05:58.000Z", "modified": "2019-12-26T17:05:58.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--5e04e696-4e74-4be0-a8e1-4cee02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:05:58.000Z", "modified": "2019-12-26T17:05:58.000Z", "name": "OSINT - Let\u00e2\u20ac\u2122s play (again) with Predator the thief \u00e2\u20ac\u201c Fumik0_'s box", "published": "2019-12-26T17:06:31Z", "object_refs": [ "indicator--5e04e6ad-a28c-4a80-98ba-4aec02de0b81", "indicator--5e04e6ad-aea8-4bd4-a8ca-42c502de0b81", "indicator--5e04e6ad-7690-4a4b-bd92-4fd802de0b81", "indicator--5e04e6ad-f3e4-4cf9-953d-478302de0b81", "indicator--5e04e6ad-a02c-4e88-bc60-453502de0b81", "indicator--5e04e6ad-e90c-47c7-999d-488702de0b81", "indicator--5e04e6ad-7c40-4b8b-997b-440302de0b81", "indicator--5e04e6c1-41c8-4a8d-9072-a4f6950d210f", "indicator--5e04e73d-f834-4bdb-b1ef-468c02de0b81", "indicator--5e04e73d-14e0-465d-a699-482702de0b81", "indicator--5e04e73d-5688-42a8-94b1-4bff02de0b81", "observed-data--5e04e7bd-3f00-4689-8eb0-506f02de0b81", "url--5e04e7bd-3f00-4689-8eb0-506f02de0b81", "indicator--38108716-d461-41c6-8f58-0c2e5faa9f64", "x-misp-object--480d06d8-d9b8-4ced-97d8-5a1dd2b938f3", "indicator--7dd2b52a-6440-4cc6-9142-24b33b288eec", "x-misp-object--60e31b6e-033c-4edf-8e19-187bf909e409", "indicator--d4a24fd0-9810-4c54-86ba-631f43d4e22c", "x-misp-object--c62ace2f-f3d3-4207-be63-75b867775faf", "indicator--50c3e941-eafb-46ac-9dd7-96753fea8e57", "x-misp-object--ecd2c5e0-2e9f-4c69-bc0c-c23961b9e132", "indicator--63aa563e-87b6-4727-808c-1f8dbd42ecf2", "x-misp-object--7bf812c0-54af-47f5-8085-751942a1c16c", "indicator--4dce2aca-173e-45d5-ac70-39b11b0bde68", "x-misp-object--f0633bef-4096-48ac-8076-42f96522515a", "indicator--b146e56a-7421-4e1c-90a6-05e350142898", "x-misp-object--2a62535e-e6ab-4678-91ed-333564e64814", "indicator--1c1bc6e2-3c6f-4111-b421-87e1e5a05b9d", "x-misp-object--fd386d29-307f-462e-bd14-57bd67528cee", "x-misp-object--5e04e875-85b4-466b-9115-507002de0b81", "relationship--44463079-3524-4cca-953b-b97690264e8c", "relationship--ebf1d85d-d4ce-46c7-8bc0-02dcce729d04", "relationship--03b79a82-8891-471b-ba54-c542a0acb0fa", "relationship--1cddfb38-c9a1-4d45-b009-578cd1cc3f6a", "relationship--c7d90ae3-3479-4561-bc87-7250fbbe7421", "relationship--0d04fec6-1468-4143-9b36-2ef89b4ded2e", "relationship--2e7b33f8-71be-4ed7-999b-5f8d86edd79b", "relationship--44830ce8-42bf-4353-b9df-03820469f29f" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "misp-galaxy:malpedia=\"Predator The Thief\"", "type:OSINT", "osint:lifetime=\"perpetual\"", "osint:source-type=\"blog-post\"", "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1503\"", "misp-galaxy:mitre-attack-pattern=\"Exploitation for Credential Access - T1212\"", "misp-galaxy:mitre-attack-pattern=\"Credentials in Files - T1081\"", "misp-galaxy:mitre-attack-pattern=\"Credentials in Registry - T1214\"", "misp-galaxy:mitre-attack-pattern=\"Credential Dumping - T1003\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e04e6ad-a28c-4a80-98ba-4aec02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T16:58:21.000Z", "modified": "2019-12-26T16:58:21.000Z", "description": "Other predator hashes", "pattern": "[file:hashes.MD5 = '9110e59b6c7ced21e194d37bb4fc14b2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T16:58:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e04e6ad-aea8-4bd4-a8ca-42c502de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T16:58:21.000Z", "modified": "2019-12-26T16:58:21.000Z", "description": "Other predator hashes", "pattern": "[file:hashes.MD5 = '51e1924ac4c3f87553e9e9c712348ac8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T16:58:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e04e6ad-7690-4a4b-bd92-4fd802de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T16:58:21.000Z", "modified": "2019-12-26T16:58:21.000Z", "description": "Other predator hashes", "pattern": "[file:hashes.MD5 = 'fe6125adb3cc69aa8c97ab31a0e7f5f8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T16:58:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e04e6ad-f3e4-4cf9-953d-478302de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T16:58:21.000Z", "modified": "2019-12-26T16:58:21.000Z", "description": "Other predator hashes", "pattern": "[file:hashes.MD5 = '02484e00e248da80c897e2261e65d275']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T16:58:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e04e6ad-a02c-4e88-bc60-453502de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T16:58:21.000Z", "modified": "2019-12-26T16:58:21.000Z", "description": "Other predator hashes", "pattern": "[file:hashes.MD5 = 'a86f18fa2d67415ac2d576e1cd5ccad8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T16:58:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e04e6ad-e90c-47c7-999d-488702de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T16:58:21.000Z", "modified": "2019-12-26T16:58:21.000Z", "description": "Other predator hashes", "pattern": "[file:hashes.MD5 = '3861a092245655330f0f1ffec75aca67']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T16:58:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e04e6ad-7c40-4b8b-997b-440302de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T16:58:21.000Z", "modified": "2019-12-26T16:58:21.000Z", "description": "Other predator hashes", "pattern": "[file:hashes.MD5 = 'ed3893c96decc3aa798be93192413d28']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T16:58:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e04e6c1-41c8-4a8d-9072-a4f6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T16:58:41.000Z", "modified": "2019-12-26T16:58:41.000Z", "description": "C&C", "pattern": "[domain-name:value = 'cadvexmail19mn.world']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T16:58:41Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e04e73d-f834-4bdb-b1ef-468c02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:00:45.000Z", "modified": "2019-12-26T17:00:45.000Z", "pattern": "[file:hashes.SHA256 = '21ebdc3a58f3d346247b2893d41c80126edabb060759af846273f9c9d0c92a9a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T17:00:45Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e04e73d-14e0-465d-a699-482702de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:00:45.000Z", "modified": "2019-12-26T17:00:45.000Z", "pattern": "[file:hashes.SHA256 = '6e27a2b223ef076d952aaa7c69725c831997898bebcd2d99654f4a1aa3358619']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T17:00:45Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e04e73d-5688-42a8-94b1-4bff02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:00:45.000Z", "modified": "2019-12-26T17:00:45.000Z", "pattern": "[file:hashes.SHA256 = '01ef26b464faf08081fceeeb2cdff7a66ffdbd31072fe47b4eb43c219da287e8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T17:00:45Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5e04e7bd-3f00-4689-8eb0-506f02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:53.000Z", "modified": "2019-12-26T17:02:53.000Z", "first_observed": "2019-12-26T17:02:53Z", "last_observed": "2019-12-26T17:02:53Z", "number_observed": 1, "object_refs": [ "url--5e04e7bd-3f00-4689-8eb0-506f02de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5e04e7bd-3f00-4689-8eb0-506f02de0b81", "value": "https://fumik0.com/2019/12/25/lets-play-again-with-predator-the-thief/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--38108716-d461-41c6-8f58-0c2e5faa9f64", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:38.000Z", "modified": "2019-12-26T17:02:38.000Z", "pattern": "[file:hashes.MD5 = '3861a092245655330f0f1ffec75aca67' AND file:hashes.SHA1 = 'ce44e7d00cf55e8bf13f5c52bfbdbe3d4603bfa1' AND file:hashes.SHA256 = '6b02aa8fc222f1f46ffcea8ac02474d8f0ef10f7d48986348da9e2ac8c519db9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T17:02:38Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--480d06d8-d9b8-4ced-97d8-5a1dd2b938f3", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:38.000Z", "modified": "2019-12-26T17:02:38.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-12-07T18:46:23", "category": "Other", "comment": "Other predator hashes", "uuid": "96d5c98a-5ac5-44c2-9f1a-353b10f7a0ab" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/6b02aa8fc222f1f46ffcea8ac02474d8f0ef10f7d48986348da9e2ac8c519db9/analysis/1575744383/", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "e60bda6a-dab6-444e-a401-15142aa21064" }, { "type": "text", "object_relation": "detection-ratio", "value": "27/70", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "1e54635d-bec8-4e0b-93df-c8641ba189dd" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7dd2b52a-6440-4cc6-9142-24b33b288eec", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:38.000Z", "modified": "2019-12-26T17:02:38.000Z", "pattern": "[file:hashes.MD5 = 'fe6125adb3cc69aa8c97ab31a0e7f5f8' AND file:hashes.SHA1 = '7cc5b92224347c6e3d695b7e67dc841210b9ad04' AND file:hashes.SHA256 = '9166ef682132814d0286ddecfefcc4222759cb9dcf62f7014c53b6367d3d28c3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T17:02:38Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--60e31b6e-033c-4edf-8e19-187bf909e409", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:39.000Z", "modified": "2019-12-26T17:02:39.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-12-20T09:59:07", "category": "Other", "comment": "Other predator hashes", "uuid": "856067c0-03fa-47c2-b886-6e4e3210d5a6" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/9166ef682132814d0286ddecfefcc4222759cb9dcf62f7014c53b6367d3d28c3/analysis/1576835947/", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "ab78c3d0-dc09-4de4-9692-9a4dda23a176" }, { "type": "text", "object_relation": "detection-ratio", "value": "51/70", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "ed280824-6ca1-4c77-897c-9c5e7c0abdf5" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d4a24fd0-9810-4c54-86ba-631f43d4e22c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:39.000Z", "modified": "2019-12-26T17:02:39.000Z", "pattern": "[file:hashes.MD5 = 'a86f18fa2d67415ac2d576e1cd5ccad8' AND file:hashes.SHA1 = '7dfe085e01e8285139d16455e810ae4792eb2c18' AND file:hashes.SHA256 = 'd24a2e930976774bc5f9d3246f94e1c93a707d33ed7e392cfe01bb3677cc1c22']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T17:02:39Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--c62ace2f-f3d3-4207-be63-75b867775faf", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:39.000Z", "modified": "2019-12-26T17:02:39.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-12-25T07:19:31", "category": "Other", "comment": "Other predator hashes", "uuid": "89df942c-9005-4f34-80f1-ea4719b6c95f" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/d24a2e930976774bc5f9d3246f94e1c93a707d33ed7e392cfe01bb3677cc1c22/analysis/1577258371/", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "54923d4a-fa00-4d06-8660-aa1ddc99389a" }, { "type": "text", "object_relation": "detection-ratio", "value": "57/71", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "0594f440-9360-4876-b34e-ef99ffe3469b" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--50c3e941-eafb-46ac-9dd7-96753fea8e57", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:39.000Z", "modified": "2019-12-26T17:02:39.000Z", "pattern": "[file:hashes.MD5 = 'ed3893c96decc3aa798be93192413d28' AND file:hashes.SHA1 = '32037e67ab590dbe7015109aed258035dbb0808a' AND file:hashes.SHA256 = '8ec9b712fe5f0648f015b582abca33ebbdb49670c547fdb074051f6b03c6ffc9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T17:02:39Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--ecd2c5e0-2e9f-4c69-bc0c-c23961b9e132", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:40.000Z", "modified": "2019-12-26T17:02:40.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-12-02T16:08:23", "category": "Other", "comment": "Other predator hashes", "uuid": "9dcde278-2ff3-44d6-8ea8-46d6738629e6" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/8ec9b712fe5f0648f015b582abca33ebbdb49670c547fdb074051f6b03c6ffc9/analysis/1575302903/", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "5e9f6929-d276-4a11-87ec-13f4ea380c78" }, { "type": "text", "object_relation": "detection-ratio", "value": "33/70", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "feed86f7-129f-4de7-b836-38337265abbc" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--63aa563e-87b6-4727-808c-1f8dbd42ecf2", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:40.000Z", "modified": "2019-12-26T17:02:40.000Z", "pattern": "[file:hashes.MD5 = '9110e59b6c7ced21e194d37bb4fc14b2' AND file:hashes.SHA1 = '3359490391fb18bbe18ba12341b7476b79dac376' AND file:hashes.SHA256 = '7e666e1f9ed0cfc211096d54106d66ba47f0375e675814b44c24b34dad57f578']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T17:02:40Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--7bf812c0-54af-47f5-8085-751942a1c16c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:40.000Z", "modified": "2019-12-26T17:02:40.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-12-13T17:23:41", "category": "Other", "comment": "Other predator hashes", "uuid": "f9a8fab5-cfe1-4e83-9473-fe78cf056bce" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/7e666e1f9ed0cfc211096d54106d66ba47f0375e675814b44c24b34dad57f578/analysis/1576257821/", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "72865949-620a-4098-b04c-59f9d39bfded" }, { "type": "text", "object_relation": "detection-ratio", "value": "48/71", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "1011e2ec-c6d5-4479-9e24-040bb1dc1189" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4dce2aca-173e-45d5-ac70-39b11b0bde68", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:40.000Z", "modified": "2019-12-26T17:02:40.000Z", "pattern": "[file:hashes.MD5 = '51e1924ac4c3f87553e9e9c712348ac8' AND file:hashes.SHA1 = '7f81cdffcab77a07b1e15298d5b7c6681c0e5c6c' AND file:hashes.SHA256 = '271d39c0daaf1efb3571fcb7cf2b271f882aebe070176d777e3dcbbbe1d80002']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T17:02:40Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--f0633bef-4096-48ac-8076-42f96522515a", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:41.000Z", "modified": "2019-12-26T17:02:41.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-12-25T23:50:06", "category": "Other", "comment": "Other predator hashes", "uuid": "8f960a45-2cda-48b5-af90-bc324e624589" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/271d39c0daaf1efb3571fcb7cf2b271f882aebe070176d777e3dcbbbe1d80002/analysis/1577317806/", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "6815fe07-a65c-4e36-9ae8-e061f2d81996" }, { "type": "text", "object_relation": "detection-ratio", "value": "44/72", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "ff524555-72ff-4dfe-ae4b-9b94c8f058fe" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b146e56a-7421-4e1c-90a6-05e350142898", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:41.000Z", "modified": "2019-12-26T17:02:41.000Z", "pattern": "[file:hashes.MD5 = '02484e00e248da80c897e2261e65d275' AND file:hashes.SHA1 = '8a1550d7d473c85cb8bdadce151eb66dce8bc7cc' AND file:hashes.SHA256 = '8f33307a23babe5b961fd72184274a34cad2218916ac343baa131290ff018e57']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T17:02:41Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--2a62535e-e6ab-4678-91ed-333564e64814", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:41.000Z", "modified": "2019-12-26T17:02:41.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-12-23T11:50:24", "category": "Other", "comment": "Other predator hashes", "uuid": "8e218d95-e946-45f4-9279-f13ac5a15eb9" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/8f33307a23babe5b961fd72184274a34cad2218916ac343baa131290ff018e57/analysis/1577101824/", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "b8ef1188-4a8f-4b05-9781-9c94c02046c8" }, { "type": "text", "object_relation": "detection-ratio", "value": "47/71", "category": "Payload delivery", "comment": "Other predator hashes", "uuid": "5f67fdb9-1ef5-41ab-9320-11685191e102" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1c1bc6e2-3c6f-4111-b421-87e1e5a05b9d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:41.000Z", "modified": "2019-12-26T17:02:41.000Z", "pattern": "[file:hashes.MD5 = '82ec8cb11e560681ffe5a2ee1397ba40' AND file:hashes.SHA1 = 'a3349ccc3ccc58424b6855dceaa740d9d144eedf' AND file:hashes.SHA256 = '21ebdc3a58f3d346247b2893d41c80126edabb060759af846273f9c9d0c92a9a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-26T17:02:41Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--fd386d29-307f-462e-bd14-57bd67528cee", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:02:41.000Z", "modified": "2019-12-26T17:02:41.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-11-06T00:05:26", "category": "Other", "uuid": "00c15ce8-a3c2-4a45-97c2-0099d1251967" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/21ebdc3a58f3d346247b2893d41c80126edabb060759af846273f9c9d0c92a9a/analysis/1572998726/", "category": "Payload delivery", "uuid": "25eefa9c-ab55-4d28-80ae-513162e3c225" }, { "type": "text", "object_relation": "detection-ratio", "value": "52/72", "category": "Payload delivery", "uuid": "c55d65e8-361e-4d20-887a-b57b56a73cc6" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5e04e875-85b4-466b-9115-507002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-26T17:05:57.000Z", "modified": "2019-12-26T17:05:57.000Z", "labels": [ "misp:name=\"annotation\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "text", "object_relation": "format", "value": "markdown", "category": "Other", "uuid": "5e04e876-5a80-4348-bbf9-507002de0b81" }, { "type": "text", "object_relation": "type", "value": "report", "category": "Other", "uuid": "5e04e876-d1f0-46cf-86f2-507002de0b81" }, { "type": "text", "object_relation": "text", "value": "[](https://fumik0.com)\r\n\r\n* [Home](https://fumik0.com/)\r\n* [Tracker](http://tracker.fumik0.com)\r\n* [Twitter](https://twitter.com/fumik0_)\r\n* [About](https://fumik0.com/about/)\r\n* [Contact](https://fumik0.com/contact/)\r\n\r\n* [Home](https://fumik0.com)\r\n* [botnet](https://fumik0.com/category/botnet/)\r\n* Let\u00e2\u20ac\u2122s play (again) with Predator the thief\r\n\r\n# Let\u00e2\u20ac\u2122s play (again) with Predator the thief\r\n\r\n[0](https://fumik0.com/2019/12/25/lets-play-again-with-predator-the-thief/#comments)\r\n\r\n![](:/5d9c033aa2614a1584eda9e4756ad915) [fumko](https://fumik0.com/author/fumko/ \"written December 25, 2019 @ 7:49 pm\") written 21 hours ago\r\n\r\n![](:/3189a43320a24016869436b1919bdb67)\r\n\r\nWhenever I reverse a sample, I am mostly interested in how it was developed, even if in the end the techniques employed are generally the same, I am always curious about what was the way to achieve a task, or just simply understand the code philosophy of a piece of code. It is a very nice way to spot different trending and discovering (sometimes) new tricks that you never know it was possible to do. This is one of the main reasons, I love digging mostly into stealers/clippers for their accessibility for being reversed, and enjoying malware analysis as a kind of game (unless some exceptions like Nymaim that is literally hell).\r\n\r\nIt's been 1 year and a half now that I start looking into \"Predator The Thief\", and this malware has evolved over time in terms of content added and code structure. This impression could be totally different from others in terms of stealing tasks performed, but based on my first in-depth analysis,, the code has changed too much and it was necessary to make another post on it.\r\n\r\nThis one will focus on some major aspects of the 3.3.2 version, but will not explain everything (because some details have already been mentioned in other papers,\u00c2\u00a0 some subjects are known). Also, times to times I will add some extra commentary about malware analysis in general.\r\n\r\n## Anti-Disassembly\r\n\r\nWhen you open an unpacked binary in IDA or other disassembler software like GHIDRA, there is an amount of code that is not interpreted correctly which leads to rubbish code, the incapacity to construct instructions or showing some graph. Behind this, it's obvious that an anti-disassembly trick is used.\r\n\r\n\r\n\r\nThe technique exploited here is known and used in the wild by other malware, it requires just a few opcodes to process and leads at the end at the creation of a false branch. In this case, it begins with a simple xor instruction that focuses on configuring the zero flag and forcing the JZ jump condition to work no matter what, so, at this stage, it's understandable that something suspicious is in progress. Then the MOV opcode (0xB8) next to the jump is a 5 bytes instruction and disturbing the disassembler to consider that this instruction is the right one to interpret beside that the correct opcode is inside this one, and in the end, by choosing this wrong path malicious tasks are hidden.\r\n\r\nOf course, fixing this issue is simple, and required just a few seconds. For example with IDA, you need to undefine the MOV instruction by pressing the keyboard shortcut \"U\", to produce this pattern.\r\n\r\n![predator_anti_analysis_03](:/49ceced72dd147d19759ebb547322859)\r\n\r\nThen skip the 0xB8 opcode, and pushing on \"C\" at the 0xE8 position, to configure the disassembler to interpret instruction at this point.\r\n\r\n\r\n\r\nReplacing the 0xB8 opcode by 0x90. with a hexadecimal editor, will fix the issue. Opening again the patched PE, you will see that IDA is now able to even show the graph mode.\r\n\r\nAfter patching it, there are still some parts that can't be correctly parsed by the disassembler, but after reading some of the code locations, some of them are correct, so if you want to create a function, you can select the \"loc\" section then pushed on \"P\" to create a sub-function, of course, this action could lead to some irreversible thing if you are not sure about your actions and end to restart again the whole process to remove a the ant-disassembly tricks, so this action must be done only at last resort.\r\n\r\n## Code Obfuscation\r\n\r\nWhenever you are analyzing Predator, you know that you will have to deal with some obfuscation tricks almost everywhere just for slowing down your code analysis. Of course, they are not complicated to assimilate, but as always, simple tricks used at their finest could turn a simple fun afternoon to literally \"welcome to Dark Souls\". The concept was already there in the first in-depth analysis of this malware, and the idea remains over and over with further updates on it. The only differences are easy to guess :\r\n\r\n* More layers of obfuscation have been added\r\n* Techniques already used are just adjusted.\r\n* More dose of randomness\r\n\r\nAs a reversing point of view, I am considering this part as one the main thing to recognized this stealer, even if of course, you can add network communication and C&C pattern as other ways for identifying it, inspecting the code is one way to clarify doubts (and I understand that this statement is for sure not working for every malware), but the idea is that nowadays it's incredibly easy to make mistakes by being dupe by rules or tags on sandboxes, due to similarities based on code-sharing, or just literally creating false flag.\r\n\r\n#### GetModuleAddress\r\n\r\nAlready there in a previous analysis, recreating the GetProcAddress is a popular trick to hide an API call behind a simple register call. Over the updates, the main idea is still there but the main procedures have been modified, reworked or slightly optimized.\r\n\r\nFirst of all, we recognized easily the PEB retrieved by spotting fs\\[0x30\\] behind some extra instructions.\r\n\r\n![predator_getmodulehandle_01](:/77ab5eda16f24fc69efd065ec50ef85f)\r\n\r\nthen from it, the loader data section is requested for two things:\r\n\r\n* Getting the InLoadOrderModuleList pointer\r\n* Getting the InMemoryOrderModuleList pointer\r\n\r\nFor those who are unfamiliar by this, basically, the PEB\\_LDR\\_DATA is a structure is where is stored all the information related to the loaded modules of the process.\r\n\r\nThen, a loop is performing a basic search on every entry of the module list but in \"memory order\" on the loader data, by retrieving the module name, generating a hash of it and when it's done, it is compared with a hardcoded obfuscated hash of the kernel32 module and obviously, if it matches, the module base address is saved, if it's not, the process is repeated again and again.\r\n\r\n\r\n\r\nThe XOR kernel32 hashes compared with the one created\r\n\r\nNowadays, using hashes for a function name or module name is something that you can see in many other malware, purposes are multiple and this is one of the ways to hide some actions. An example of this code behavior could be found easily on the internet and as I said above, this one is popular and already used.\r\n\r\n#### GetProcAddress / GetLoadLibrary\r\n\r\nAlways followed by GetModuleAddress, the code for recreating GetProcAddress is by far the same architecture model than the v2, in term of the concept used. If the function is forwarded, it will basically perform a recursive call of itself by getting the forward address, checking if the library is loaded then call GetProcAddress again with new values.\r\n\r\n#### Xor everything\r\n\r\nIt's almost unnecessary to talk about it, but as in-depth analysis, if you have never read the other article before, it's always worth to say some words on the subject (as a reminder). The XOR encryption is a common cipher that required a rudimentary implementation for being effective :\r\n\r\n* Only one operator is used (XOR)\r\n* it's not consuming resources.\r\n* It could be used as a component of other ciphers\r\n\r\nThis one is extremely popular in malware and the goal is not really to produce strong encryption because it's ridiculously easy to break most of the time, they are used for hiding information or keywords that could be triggering alerts, rules...\r\n\r\n* Communication between host & server\r\n* Hiding strings\r\n* Or... simply used as an absurd step for obfuscating the code\r\n* etc...\r\n\r\nA typical example in Predator could be seeing huge blocks with only two instructions (XOR & MOV), where stacks strings are decrypted X bytes per X bytes by just moving content on a temporary value (stored on EAX), XORed then pushed back to EBP, and the principle is reproduced endlessly again and again. This is rudimentary, In this scenario, it's just part of the obfuscation process heavily abused by predator, for having an absurd amount of instruction for simple things.\r\n\r\n![predator_xor_01](:/9511ae3268cd4785a93a85c7a8eaf603)\r\n\r\nAlso for some cases, When a hexadecimal/integer value is required for an API call, it could be possible to spot another pattern of a hardcoded string moved to a register then only one XOR instruction is performed for revealing the correct value, this trivial thing is used for some specific cases like the correct position in the TEB for retrieving the PEB, an RVA of a specific module, ...\r\n\r\n![predator_ntsetinformationthread](:/2c330e4789764f69ba2d35cd0d51552c)\r\n\r\nFinally, the most common one, there is also the classic one used by using a for loop for a one key length XOR key, seen for decrypting modules, functions, and other things...\r\n\r\n```\r\nstr = ... # encrypted string\r\n\r\nfor i, s in enumerate(str):\r\n s[i] = s[i] ^ s[len(str)-1]\r\n```\r\n\r\n#### Sub everything\r\n\r\nLet's consider this as a perfect example of \"let's do the same exact thing by just changing one single instruction\", so in the end, a new encryption method is used with no effort for the development. That's how a SUB instruction is used for doing the substitution cipher. The only difference that I could notice it's how the key is retrieved.\r\n\r\n![predator_sub_02](:/51dd011697d44c1aa47601d2dbfd0d8f)\r\n\r\nBesides having something hardcoded directly, a signed 32-bit division is performed, easily noticeable by the use of cdq & idiv instructions, then the dl register (the remainder) is used for the substitution.\r\n\r\n#### Stack Strings\r\n\r\n![stack strings](:/46763538c67645b4b1c9f1c31317f845)\r\n\r\n#### What's the result in the end?\r\n\r\nMerging these obfuscation techniques leads to a nonsense amount of instructions for a basic task, which will obviously burn you some hours of analysis if you don't take some time for cleaning a bit all that mess with the help of some scripts or plenty other ideas, that could trigger in your mind. It could be nice to see these days some scripts released by the community.\r\n\r\n![predator_main](:/0233493aebc24c369edfcf8ef1b7303f)\r\n\r\nSimple tricks lead to nonsense code\r\n\r\n## Anti-Debug\r\n\r\nThere are plenty of techniques abused here that was not in the first analysis, this is not anymore a simple PEB.BeingDebugged or checking if you are running a virtual machine, so let's dig into them. one per one except CheckRemoteDebugger! This one is enough to understand by itself :')\r\n\r\n**NtSetInformationThread**\r\n\r\nOne of the oldest tricks in windows and still doing its work over the years. Basically in a very simple way (because there is a lot thing happening during the process), NtSetInformationThread is called with a value (0x11) obfuscated by a XOR operator. This parameter is a ThreadInformationClass with a specific enum called ThreadHideFromDebugger and when it's executed, the debugger is not able to catch any debug information. So the supposed pointer to the corresponding thread is, of course, the malware and when you are analyzing it with a debugger, it will result to detach itself.\r\n\r\n\r\n\r\n#### CloseHandle/NtClose\r\n\r\nInside WinMain, a huge function is called with a lot of consecutive anti-debug tricks, they were almost all indirectly related to some techniques patched by TitanHide (or strongly looks like), the first one performed is a really basic one, but pretty efficient to do the task.\r\n\r\nBasically, when CloseHandle is called with an inexistent handle or an invalid one, it will raise an exception and whenever you have a debugger attached to the process, it will not like that at all. To guarantee that it's not an issue for a normal interaction a simple \\_\\_try / \\_\\_except method is used, so if this API call is requested, it will safely lead to the end without any issue.\r\n\r\n\r\n\r\nThe invalid handle used here is a static one and it's L33T code with the value _0xBAADAA55_ and makes me bored as much as this face.\r\n\r\n![not_amused](:/a5e60d374b5746738b4658ba975437cd)\r\n\r\nThat's not a surprise to see stuff like this from the malware developer. Inside jokes, l33t values, animes and probably other content that I missed are something usual to spot on Predator.\r\n\r\n**ProcessDebugObjectHandle**\r\n\r\nWhen you are debugging a process, Microsoft Windows is creating a \"Debug\" object and a handle corresponding to it. At this point, when you want to check if this object exists on the process, NtQueryInformationProcess is used with the ProcessInfoClass initialized by\u00c2\u00a0 0x1e (that is in fact, ProcessDebugObjectHandle).\r\n\r\n![predator_antidebug](:/4ac1646776e443f4b9a3649a5f28871a)\r\n\r\nIn this case, the NTStatus value (returning result by the API call) is an error who as the ID 0xC0000353, aka STATUS\\_PORT\\_NOT_SET. This means, _\"An attempt to remove a process's DebugPort was made, but a port was not already associated with the process.\"._ The anti-debug trick is to verify if this error is there, that's all.\r\n\r\n**NtGetContextThread**\r\n\r\nThis one is maybe considered as pretty wild if you are not familiar with some hardware breakpoints. Basically, there are some registers that are called \"**D**ebug **R**egister\" and they are using the **DR**X nomenclature\u00c2\u00a0 (DR0 to DR7). When GetThreadContext is called, the function will retrieve al the context information from a thread.\r\n\r\nFor those that are not familiar with a context structure, it contains all the register data from the corresponding element. So, with this data in possession, it only needs to check if those DRX registers are initiated with a value not equal to 0.\r\n\r\n![predator_getthreadcontext](:/bb5fd119616a4718ac160aee2945d03e)\r\n\r\nOn the case here, it's easily spottable to see that 4 registers are checked\r\n\r\n```\r\nif (ctx->Dr0 != 0 || ctx->Dr1 != 0 || ctx->Dr2 != 0 || ctx->Dr3 != 0)\r\n```\r\n\r\n**Int 3 breakpoint**\r\n\r\nint 3 (or Interrupt 3) is a popular opcode to force the debugger to stop at a specific offset. As said in the title, this is a breakpoint but if it's executed without any debugging environment, the exception handler is able to deal with this behavior and will continue to run without any issue. Unless I missed something, here is the scenario.\r\n\r\n![predator_breakpoint](:/16b5117a2d9a48f6b1c76c8cb53d0f6a)\r\n\r\nBy the way,\u00c2\u00a0 as another scenario used for this one (the int 3), the number of this specific opcode triggered could be also used as an incremented counter, if the counter is above a specific value, a simplistic condition is sufficient to check if it's executed into a debugger in that way.\r\n\r\n#### Debug Condition\r\n\r\nWith all the techniques explained above, in the end, they all lead to a final condition step if of course, the debugger hasn't crashed. The checking task is pretty easy to understand and it remains to a simple operation: \"setting up a value to EAX during the anti-debug function\", if everything is correct this register will be set to zero, if not we could see all the different values that could be possible.\r\n\r\n\r\n\r\nbloc in red is the correct condition over all the anti-debug tests\r\n\r\n...And when the Anti-Debug function is done, the register EAX is checked by the test operator, so the ZF flag is determinant for entering into the most important loop that contains the main function of the stealer.\r\n\r\n![predator_anti_debug_02](:/aa1917279a3f456db1ec5e8436ba0191)\r\n\r\n## Anti-VM\r\n\r\nThe Anti VM is presented as an option in Predator and is performed just after the first C&C requests.\r\n\r\n![Anti-VM-Predator-Option](:/7f0c3bc4e2be4e92b0e0a04dc3800043)\r\n\r\nTricks used are pretty olds and basically using Anti-VM Instructions\r\n\r\n* SIDT\r\n* SGDT\r\n* STR\r\n* CPUID (Hypervisor Trick)\r\n\r\nBy curiosity, this option is not by default performed if the C&C is not reachable.\r\n\r\n## Paranoid & Organized Predator\r\n\r\nWhen entering into the \"big main function\", the stealer is doing \"again\" extra validations if you have a valid payload (and not a modded one), you are running it correctly and being sure again that you are not analyzing it.\r\n\r\nThis kind of paranoid checking step is a result of the multiple cases of cracked builders developed and released in the wild (mostly or exclusively at a time coming from XakFor.Net). Pretty wild and fun to see when Anti-Piracy protocols are also seen in the malware scape.\r\n\r\nThen the malware is doing a classic organized setup to perform all the requested actions and could be represented in that way.\r\n\r\n![Predator_Roadmap](:/b56434e7ec724683bcfbe1c936b0df90)\r\n\r\nOf course as usual and already a bit explained in the first paper, the C&C domain is retrieved in a table of function pointers before the execution of the WinMain function (where the payload is starting to do tasks).\r\n\r\n\r\n\r\nYou can see easily all the functions that will be called based on the starting location (\\_\\_xc\\_z) and the ending location (\\_\\_xc\\_z).\r\n\r\n![pointer_c2](:/aad71fabe7f64795880979049d31355f)\r\n\r\nThen you can spot easily the XOR strings that hide the C&C domain like the usual old predator malware.\r\n\r\n![xor_c2_domain](:/a25802af12ea44d5b29231b2ea437137)\r\n\r\n## Data Encryption & Encoding\r\n\r\nBesides using XOR almost absolutely everywhere, this info stealer is using a mix of RC4 encryption and base64 encoding whenever it is receiving data from the C&C. Without using specialized tools or paid versions of IDA (or whatever other software), it could be a bit challenging to recognize it (when you are a junior analyst), due to some modification of some part of the code.\r\n\r\n### Base64\r\n\r\nFor the Base64 functions, it's extremely easy to spot them, with the symbol values on the register before and after calls. The only thing to notice with them, it's that they are using a typical signature... A whole bloc of XOR stack strings, I believed that this trick is designed to hide an eventual Base64 alphabet from some Yara rules.\r\n\r\n\r\n\r\nBy the way, the rest of the code remains identical to standard base64 algorithms.\r\n\r\n### RC4\r\n\r\nFor RC4, things could be a little bit messy if you are not familiar at all with encryption algorithm on a disassembler/debugger, for some cases it could be hell, for some case not. Here, it's, in fact, this amount of code for performing the process.\r\n\r\n![RC4](:/eade660840fa489b83898ee6b25dd670)\r\n\r\nBlocs are representing the Generation of the array S, then performing the Key-Scheduling Algorithm (KSA) by using a specific secret key that is, in fact, the C&C domain! (if there is no domain, but an IP hardcoded, this IP is the secret key), then the last one is the Pseudo-random generation algorithm (PRGA).\r\n\r\nFor more info, some resources about this algorithm below:\r\n\r\n* [Stack Overflow example](https://stackoverflow.com/questions/29607753/how-to-decrypt-a-file-that-encrypted-with-rc4-using-python)\r\n* [RC4 Algorithm (Wikipedia)](https://en.wikipedia.org/wiki/RC4#Key-scheduling_algorithm_(KSA))\r\n\r\n## Mutex & Hardware ID\r\n\r\nThe Hardware ID (HWID) and mutex are related, and the generation is quite funky,\u00c2\u00a0 I would say, even if most of the people will consider this as something not important to investigate, I love small details in malware, even if their role is maybe meaningless, but for me, every detail counts no matter what (even the stupidest one).\r\n\r\nHere the hardware ID generation is split into 3 main parts. I had a lot of fun to understand how this one was created.\r\n\r\nFirst, it will grab all the available logical drives on the compromised machine, and for each of them, the serial number is saved into a temporary variable. Then, whenever a new drive is found, the hexadecimal value is added to it. so basically if the two drives have the serial number \"44C5-F04D\" and \"1130-DDFF\", so ESI will receive 0x44C5F04D then will add 0x1130DFF.\r\n\r\nWhen it's done, this value is put into a while loop that will divide the value on ESI by 0xA and saved the remainder into another temporary variable, the loop condition breaks when ESI is below 1. Then the results of this operation are saved, duplicated and added to itself the last 4 bytes (i.e 1122334455 will be 1122334455**22334455**).\r\n\r\nIf this is not sufficient, the value is put into another loop for performing this operation.\r\n\r\n```\r\nfor i, s in enumerate(str):\r\n if i & 1:\r\n a += chr(s) + 0x40\r\n else:\r\n a += chr(s)\r\n```\r\n\r\nIt results in the creation of an alphanumeric string that will be the archive filename used during the POST request to the C&C.\r\n\r\n![predator_mutex](:/391e46285dec48cba97386f9d661c7ab)\r\n\r\nthe generated hardware ID based on the serial number devices\r\n\r\nBut wait! there is more... This value is in part of the creation of the mutex name... with a simple base64 operation on it and some bit operand operation for cutting part of the base64 encoding string for having finally the mutex name!\r\n\r\n## Anti-CIS\r\n\r\nA classic thing in malware, this feature is used for avoiding infecting machines coming from the Commonwealth of Independent States (CIS) by using a simple API call GetUserDefaultLangID.\r\n\r\n\r\n\r\nThe value returned is the language identifier of the region format setting for the user and checked by a lot of specific language identifier, of courses in every situation, all the values that are tested, are encrypted.\r\n\r\n| | | |\r\n| --- | --- | --- |\r\n| Language ID | SubLanguage Symbol | Country |\r\n| 0x0419 | SUBLANG\\_RUSSIAN\\_RUSSIA | Russia |\r\n| 0x042b | SUBLANG\\_ARMENIAN\\_ARMENIA | Armenia |\r\n| 0x082c | SUBLANG\\_AZERI\\_CYRILLIC | Azerbaijan |\r\n| 0x042c | SUBLANG\\_AZERI\\_LATIN | Azerbaijan |\r\n| 0x0423 | SUBLANG\\_BELARUSIAN\\_BELARUS | Belarus |\r\n| 0x0437 | SUBLANG\\_GEORGIAN\\_GEORGIA | Georgia |\r\n| 0x043f | SUBLANG\\_KAZAK\\_KAZAKHSTAN | Kazakhstan |\r\n| 0x0428 | SUBLANG\\_TAJIK\\_TAJIKISTAN | Tajikistan |\r\n| 0x0442 | SUBLANG\\_TURKMEN\\_TURKMENISTAN | Turkmenistan |\r\n| 0x0843 | SUBLANG\\_UZBEK\\_CYRILLIC | Uzbekistan |\r\n| 0x0443 | SUBLANG\\_UZBEK\\_LATIN | Uzbekistan |\r\n| 0x0422 | SUBLANG\\_UKRAINIAN\\_UKRAINE | Ukraine |\r\n\r\n## Files, files where are you?\r\n\r\nWhen I reversed for the first time this stealer, files and malicious archive were stored on the disk then deleted. But right now, this is not the case anymore. Predator is managing all the stolen data into memory for avoiding as much as possible any extra traces during the execution.\r\n\r\nPredator is nowadays creating in memory a lot of allocated pages and temporary files that will be used for interactions with real files that exist on the disk. Most of the time it's basically getting handles, size and doing some operation for opening, grabbing content and saving them to a place in memory. _**This explanation is summarized in a \"very\" simplify way because there are a lot of cases and scenarios to manage this.\u00c2\u00a0**_\r\n\r\nAnother point to notice is that the archive (using ZIP compression), is also created in memory by selecting folder/files.\r\n\r\n![zip_generation_02](:/e00a6112316d438f920b97dfa834b5a7)\r\n\r\nThe generated archive in memory\r\n\r\nIt doesn't mean that the whole architecture for the files is different, it's the same format as before.\r\n\r\n![Default_Archive](:/34cc41f77b4f49fba79d38c772e1e02e)\r\n\r\nan example of archive intercepted during the C&C Communication\r\n\r\n## Stealing\r\n\r\nAfter explaining this many times about how this stuff, the fundamental idea is boringly the same for every stealer:\r\n\r\n* Check\r\n* Analyzing (optional)\r\n* Parsing (optional)\r\n* Copy\r\n* Profit\r\n* Repeat\r\n\r\nWhat could be different behind that, is how they are obfuscating the files or values to check... and guess what... every malware has their specialties (whenever they are not decided to copy the same piece of code on Github or some whatever generic .NET stealer) and in the end, there is no black magic, just simple (or complex) enigma to solve. As a malware analyst, when you are starting into analyzing stealers, you want literally to understand everything, because everything is new, and with the time, you realized the routine performed to fetch the data and how stupid it is working well (as reminder, it might be not always that easy for some highly specific stuff).\r\n\r\nIn the end, you just want to know the targeted software, and only dig into those you haven't seen before, but every time the thing is the same:\r\n\r\n* Checking dumbly a path\r\n* Checking a register key to have the correct path of a software\r\n* Checking a shortcut path based on an icon\r\n* etc...\r\n\r\nBeside that Predator the Thief is stealing a lot of different things:\r\n\r\n1. Grabbing content from Browsers (Cookies, History, Credentials)\r\n2. Harvesting/Fetching Credit Cards\r\n3. Stealing sensible information & files from Crypto-Wallets\r\n4. Credentials from FTP Software\r\n5. Data coming from Instant communication software\r\n6. Data coming from Messenger software\r\n7. 2FA Authenticator software\r\n8. Fetching Gaming accounts\r\n9. Credentials coming from VPN software\r\n10. Grabbing specific files (also dynamically)\r\n11. Harvesting all the information from the computer (Specs, Software)\r\n12. Stealing Clipboard (if during the execution of it, there is some content)\r\n13. Making a picture of yourself (if your webcam is connected)\r\n14. Making screenshot of your desktop\r\n15. It could also include a Clipper (as a modular feature).\r\n16. And... due to the module manager, other tasks that I still don't have mentioned there (that also I don't know who they are).\r\n\r\nLet's explain just some of them that I found worth to dig into.\r\n\r\n### Browsers\r\n\r\nSince my last analysis, things changed for the browser part and it's now divided into three major parts.\r\n\r\n* Internet Explorer is analyzed in a specific function developed due that the data is contained into a \"Vault\", so it requires a specific Windows API to read it.\r\n* Microsoft Edge is also split into another part of the stealing process due that this one is using unique files and needs some tasks for the parsing.\r\n* Then, the other browsers are fetched by using a homemade static grabber\r\n\r\n![Browsers](:/f121a2cf355d4bd69fbb346d846161a6)\r\n\r\n### **Grabber n\u00c2\u00b01 (The generic one)**\r\n\r\nIt's pretty fun to see that the stealing process is using at least one single function for catching a lot of things. This generic grabber is pretty \"cleaned\" based on what I saw before even if there is no magic at all, it's sufficient to make enough damages by using a recursive loop at a specific place that will search all the required files & folders.\r\n\r\nBy comparing older versions of predator, when it was attempting to steal content from browsers and some wallets, it was checking step by step specific repositories or registry keys then processing into some loops and tasks for fetching the credentials. Nowadays, this step has been removed (for the browser part) and being part of this raw grabber that will parse everything starting to %USERS% repository.\r\n\r\n![grabber](:/4ffbf988265944bc91c7f89a11326d57)\r\n\r\nAs usual, all the variables that contain required files are obfuscated and encrypted by a simple XOR algorithm and in the end, this is the \"static\" list that the info stealer will be focused\r\n\r\n| | | |\r\n| --- | --- | --- |\r\n| File grabbed | Type | Actions |\r\n| Login Data | Chrome / Chromium based | Copy & Parse |\r\n| Cookies | Chrome / Chromium based | Copy & Parse |\r\n| Web Data | Browsers | Copy & Parse |\r\n| History | Browsers | Copy & Parse |\r\n| formhistory.sqlite | Mozilla Firefox & Others | Copy & Parse |\r\n| cookies.sqlite | Mozilla Firefox & Others | Copy & Parse |\r\n| wallet.dat | Bitcoin | Copy & Parse |\r\n| .sln | Visual Studio Projects | Copy filename into Project.txt |\r\n| main.db | Skype | Copy & Parse |\r\n| logins.json | Chrome | Copy & Parse |\r\n| signons.sqlite | Mozilla Firefox & Others | Copy & Parse |\r\n| places.sqlite | Mozilla Firefox & Others | Copy & Parse |\r\n| Last Version | Mozilla Firefox & Others | Copy & Parse |\r\n\r\n### **Grabber n\u00c2\u00b02 (The dynamic one)**\r\n\r\nThere is a second grabber in Predator The Thief, and this not only used when there is available config loaded in memory based on the first request done to the C&C. In fact, it's also used as part of the process of searching & copying critical files coming from wallets software, communication software, and others...\r\n\r\n\r\n\r\nThe \"main function\" of this dynamic grabber only required three arguments:\r\n\r\n* The path where you want to search files\r\n* the requested file or mask\r\n* A path where the found files will be put in the final archive sent to the C&C\r\n\r\n![dynamic_grabber_args](:/d080e38d6a3c495f881712ea67033ede)\r\n\r\nWhen the grabber is configured for a recursive search, it's simply adding at the end of the path the value \"..\" and checking if the next file is a folder to enter again into the same function again and again.\r\n\r\nIn the end, in the fundamentals, this is almost the same pattern as the first grabber with the only difference that in this case, there are no parsing/analyzing files in an in-depth way. It's simply this follow-up\r\n\r\n1. Find a matched file based on the requested search\r\n2. creating an entry on the stolen archive folder\r\n3. setting a handle/pointer from the grabbed file\r\n4. Save the whole content to memory\r\n5. Repeat\r\n\r\nOf course, there is a lot of particular cases that are to take in consideration here, but the main idea is like this.\r\n\r\n### **What Predator is stealing in the end?**\r\n\r\nIf we removed the dynamic grabber, this is the current list (for 3.3.2) about what kind of software that is impacted by this stealer, for sure, it's hard to know precisely on the browser all the one that is impacted due to the generic grabber, but in the end, the most important one is listed here.\r\n\r\nVPN\r\n\r\n* NordVPN\r\n\r\nCommunication\r\n\r\n* Jabber\r\n* Discord\r\n* Skype\r\n\r\nFTP\r\n\r\n* WinSCP\r\n* WinFTP\r\n* FileZilla\r\n\r\nMails\r\n\r\n* Outlook\r\n\r\n2FA Software\r\n\r\n* Authy (Inspired by Vidar)\r\n\r\nGames\r\n\r\n* Steam\r\n* Battle.net (Inspired by Kpot)\r\n* Osu\r\n\r\nWallets\r\n\r\n* Electrum\r\n* MultiBit\r\n* Armory\r\n* Ethereum\r\n* Bytecoin\r\n* Bitcoin\r\n* Jaxx\r\n* Atomic\r\n* Exodus\r\n\r\nBrowser\r\n\r\n* Mozilla Firefox (also Gecko browsers using same files)\r\n* Chrome (also Chromium browsers using same files)\r\n* Internet Explorer\r\n* Edge\r\n* Unmentioned browsers using the same files detected by the grabber.\r\n\r\nAlso beside stealing other actions are performed like:\r\n\r\n* Performing a webcam picture capture\r\n* Performing a desktop screenshot\r\n\r\n## Loader\r\n\r\nThere is currently 4 kind of loader implemented into this info stealer\r\n\r\n1. RunPE\r\n2. CreateProcess\r\n3. ShellExecuteA\r\n4. LoadPE\r\n5. LoadLibrary\r\n\r\nFor all the cases, I have explained below (on another part of this analysis) what are the options of each of the techniques performed. There is no magic, there is nothing to explain more about this feature these days. There are enough articles and tutorials that are talking about this. The only thing to notice is that Predator is designed to load the payload in different ways, just by a simple process creation or abusing some process injections (i recommend on this part, to [read the work from endgame](https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process)).\r\n\r\n## Module Manager\r\n\r\nSomething really interesting about this stealer these days, it that it developed a feature for being able to add the additional tasks as part of a module/plugin package. Maybe the name of this thing is wrongly named (i will probably be fixed soon about this statement). But now it's definitely sure that we can consider this malware as a modular one.\r\n\r\n![Module Manager](:/879319f242f849e7b514baefda0dd8cf)\r\n\r\nWhen decrypting the config from check.get, you can understand fast that a module will be launched, by looking at the last entry...\r\n\r\n\\[PREDATOR\\_CONFIG\\]#\\[GRABBER\\]#\\[NETWORK\\_INFO\\]#\\[LOADER\\]#\\[**example**\\]\r\n\r\nThis will be the name of the module that will be requested to the C&C. (this is also the easiest way to spot a new module).\r\n\r\n* **example**.get\r\n* **example**.post\r\n\r\nThe first request is giving you the config of the module (on my case it was like this), it's saved but NOT decrypted (looks like it will be dealt by the module on this part). The other request is focused on downloading the payload, decrypting it and saving it to the disk in a random folder in %PROGRAMDATA% (also the filename is generated also randomly), when it's done, it's simply executed by ShellExecuteA.\r\n\r\n\r\n\r\nAlso, another thing to notice, you know that it's designed to launch multiple modules/plugins.\r\n\r\n## Clipper (Optional module)\r\n\r\nThe clipper is one example of the Module that could be loaded by the module manager. As far as I saw, I only see this one (maybe they are other things, maybe not, I don't have the visibility for that).\r\n\r\nDisclaimer: Before people will maybe mistaken, the clipper is proper to Predator the Thief and this is NOT something coming from another actor (if it's the case, the loader part would be used).\r\n\r\n\r\n\r\nClipper WinMain function\r\n\r\nThis malware module is developed in C++, and like Predator itself, you recognized pretty well the obfuscation proper to it (Stack strings, XOR, SUB, Code spaghetti, GetProcAddress recreated...). Well, everything that you love for slowing down again your analysis.\r\n\r\nAs detailed already a little above, the module is designed to grab the config from the main program, decrypting it and starting to do the process routine indefinitely:\r\n\r\n1. Open Clipboard\r\n2. Checking content based on the config loaded\r\n3. If something matches put the malicious wallet\r\n4. Sleep\r\n5. Repeat\r\n\r\nThe clipper config is rudimentary using \"|\" as a delimiter. Mask/Regex on the left, malicious wallet on the right.\r\n\r\n```\r\n1*:1Eh8gHDVCS8xuKQNhCtZKiE1dVuRQiQ58H|\r\n3*:1Eh8gHDVCS8xuKQNhCtZKiE1dVuRQiQ58H|\r\n0x*:0x7996ad65556859C0F795Fe590018b08699092B9C|\r\nq*:qztrpt42h78ks7h6jlgtqtvhp3q6utm7sqrsupgwv0|\r\nG*:GaJvoTcC4Bw3kitxHWU4nrdDK3izXCTmFQ|\r\nX*:XruZmSaEYPX2mH48nGkPSGTzFiPfKXDLWn|\r\nL*:LdPvBrWvimse3WuVNg6pjH15GgBUtSUaWy|\r\nt*:t1dLgBbvV6sXNCMUSS5JeLjF4XhhbJYSDAe|\r\n4*:44tLjmXrQNrWJ5NBsEj2R77ZBEgDa3fEe9GLpSf2FRmhexPvfYDUAB7EXX1Hdb3aMQ9FLqdJ56yaAhiXoRsceGJCRS3Jxkn|\r\nD*:DUMKwVVAaMcbtdWipMkXoGfRistK1cC26C|\r\nA*:AaUgfMh5iVkGKLVpMUZW8tGuyjZQNViwDt|\r\n```\r\n\r\nThere is no communication with the C&C when the clipper is switching wallet, it's an offline one.\r\n\r\n## Self Removal\r\n\r\nWhen the parameters are set to 1 in the Predator config got by check.get, the malware is performing a really simple task to erase itself from the machine when all the tasks are done.\r\n\r\n![self_remove](:/0b36902d662a4cb8984fdad22a5dafdb)\r\n\r\nBy looking at the bottom of the main big function where all the task is performed, you can see two main blocs that could be skipped. these two are huge stack strings that will generate two things.\r\n\r\n* the API request \"ShellExecuteA\"\r\n* The command \"ping 127.0.0.1 & del %PATH%\"\r\n\r\nWhen all is prepared the thing is simply executed behind the classic register call. By the way, doing a ping request is one of the dozen way to do a sleep call and waiting for a little before performing the deletion.\r\n\r\n![ShellExecuteA](:/45b4ff1a92f14bd3841ab33e1ba94472)\r\n\r\n_This option is not performed by default when the malware is not able to get data from the C&C._\r\n\r\n## Telemetry files\r\n\r\nThere is a bunch of files that are proper to this stealer, which are generated during the whole infection process. Each of them has a specific meaning.\r\n\r\nInformation.txt\r\n\r\n1. Signature of the stealer\r\n2. Stealing statistics\r\n3. Computer specs\r\n4. Number of users in the machine\r\n5. List of logical drives\r\n6. Current usage resources\r\n7. Clipboard content\r\n8. Network info\r\n9. Compile-time of the payload\r\n\r\nAlso, this generated file is literally \"hell\" when you want to dig into it by the amount of obfuscated code.\r\n\r\n![Information](:/bc57c9c4f32f4f7e821a9cf52b4cc073)\r\n\r\nI can quote these following important telemetry files:\r\n\r\nSoftware.txt\r\n\r\n* Windows Build Version\r\n* Generated User-Agent\r\n* List of software installed in the machine (checking for x32 and x64 architecture folders)\r\n\r\nActions.txt\r\n\r\n* List of actions & telemetry performed by the stealer itself during the stealing process\r\n\r\nProjects.txt\r\n\r\n* List of SLN filename found during the grabber research (the static one)\r\n\r\nCookeList.txt\r\n\r\n* List of cookies content fetched/parsed\r\n\r\n## Network\r\n\r\n### User-Agent \"Builder\"\r\n\r\nSometimes features are fun to dig in when I heard about that predator is now generating dynamic user-agent, I was thinking about some things but in fact, it's way simpler than I thought.\r\n\r\nThe User-Agent is generated in 5 steps\r\n\r\n1. Decrypting a static string that contains the first part of the User-Agent\r\n2. Using GetTickCount and grabbing the last bytes of it for generating a fake builder version of Chrome\r\n3. Decrypting another static string that contains the end of the User-Agent\r\n4. Concat Everything\r\n5. Profit\r\n\r\nTihs User-Agent is shown into the software.txt logfile.\r\n\r\n### C&C Requests\r\n\r\nThere is currently 4 kind of request seen in Predator 3.3.2 (it's always a POST request)\r\n\r\n| | |\r\n| --- | --- |\r\n| _Request_ | _Meaning_ |\r\n| api/check.get | Get dynamic config, tasks and network info |\r\n| api/gate.get\u00c2\u00a0?\u00e2\u20ac\u00a6\u00e2\u20ac\u00a6 | Send stolen data |\r\n| api/.get | Get modular dynamic config |\r\n| api/.post | Get modular dynamic payload (was like this with the clipper) |\r\n\r\n### The first step - Get the config & extra Infos\r\n\r\nFor the first request, the response from the server is always in a specific form :\r\n\r\n* String obviously base64 encoded\r\n* Encrypted using RC4 encryption by using the domain name as the key\r\n\r\nWhen decrypted, the config is pretty easy to guess and also a bit complex (due to the number of options & parameters that the threat actor is able to do).\r\n\r\n```\r\n[0;1;0;1;1;0;1;1;0;512;]#[[%userprofile%\\Desktop|%userprofile%\\Downloads|%userprofile%\\Documents;*.xls,*.xlsx,*.doc,*.txt;128;;0]]#[Trakai;Republic of Lithuania;54.6378;24.9343;85.206.166.82;Europe/Vilnius;21001]#[]#[Clipper]\r\n```\r\n\r\nIt's easily understandable that the config is split by the \"#\" and each data and could be summarized like this\r\n\r\n1. The stealer config\r\n2. The grabber config\r\n3. The network config\r\n4. The loader config\r\n5. The dynamic modular config (i.e Clipper)\r\n\r\nI have represented each of them into an array with the meaning of each of the parameters (when it was possible).\r\n\r\n**Predator config**\r\n\r\n| | |\r\n| --- | --- |\r\n| Args | Meaning |\r\n| Field 1 | Webcam screenshot |\r\n| Field 2 | Anti VM |\r\n| Field 3 | Skype |\r\n| Field 4 | Steam |\r\n| Field 5 | Desktop screenshot |\r\n| Field 6 | Anti-CIS |\r\n| Field 7 | Self Destroy |\r\n| Field 8 | Telegram |\r\n| Field 9 | Windows Cookie |\r\n| Field 10 | Max size for files grabbed |\r\n| Field 11 | Powershell script (in base64) |\r\n\r\n**Grabber config**\r\n\r\n\\[\\]#\\[GRABBER\\]#\\[\\]#\\[\\]#\\[\\]\r\n\r\n| | |\r\n| --- | --- |\r\n| Args | Meaning |\r\n| Field 1 | %PATH% using \"\\|\" as a delimiter |\r\n| Field 2 | Files to grab |\r\n| Field 3 | Max sized for each file grabbed |\r\n| Field 4 | Whitelist |\r\n| Field 5 | Recursive search (0 - off \\| 1 - on) |\r\n\r\n**Network info**\r\n\r\n\\[\\]#\\[\\]#\\[NETWORK\\]#\\[\\]#\\[\\]\r\n\r\n| | |\r\n| --- | --- |\r\n| Args | Meaning |\r\n| Field 1 | City |\r\n| Field 2 | Country |\r\n| Field 3 | GPS Coordinate |\r\n| Field 4 | Time Zone |\r\n| Field 5 | Postal Code |\r\n\r\n**Loader config**\r\n\r\n\\[\\]#\\[\\]#\\[\\]#\\[LOADER\\]#\\[\\]\r\n\r\n**Format**\r\n\r\n\\[\\[URL;3;2;;;;1;amazon.com;0;0;1;0;0;5\\]\\]\r\n\r\n**Meaning**\r\n\r\n1. Loader URL\r\n2. Loader Type\r\n3. Architecture\r\n4. Targeted Countries (\",\" as a delimiter)\r\n5. Blacklisted Countries (\",\" as a delimiter)\r\n6. Arguments on startup\r\n7. Injected process OR Where it's saved and executed\r\n8. Pushing loader if the specific domain(s) is(are) seen in the stolen data\r\n9. Pushing loader if wallets are presents\r\n10. Persistence\r\n11. Executing in admin mode\r\n12. Random file generated\r\n13. Repeating execution\r\n14. ???\r\n\r\n**Loader type (argument 2)**\r\n\r\n| | |\r\n| --- | --- |\r\n| Value | Meaning |\r\n| 1 | RunPE |\r\n| 2 | CreateProcess |\r\n| 3 | ShellExecute |\r\n| 4 | LoadPE |\r\n| 5 | LoadLibrary |\r\n\r\n**Architecture (argument 3)**\r\n\r\n| | |\r\n| --- | --- |\r\n| Value | Meaning |\r\n| 1 | x32 / x64 |\r\n| 2 | x32 only |\r\n| 3 | x64 only |\r\n\r\n**If it's RunPE (argument 7)**\r\n\r\n| | |\r\n| --- | --- |\r\n| Value | Meaning |\r\n| 1 | Attrib.exe |\r\n| 2 | Cmd.exe |\r\n| 3 | Audiodg.exe |\r\n\r\n**If it's CreateProcess / ShellExecuteA / LoadLibrary (argument 7)**\r\n\r\n| | |\r\n| --- | --- |\r\n| Value | Meaning |\r\n| 1 | %PROGRAMDATA% |\r\n| 2 | %TEMP% |\r\n| 3 | %APPDATA% |\r\n\r\n### The second step - Sending stolen data\r\n\r\n**Format**\r\n\r\n```\r\n/api/gate.get?p1=X&p2=X&p3=X&p4=X&p5=X&p6=X&p7=X&p8=X&p9=X&p10=X\r\n```\r\n\r\n**Goal**\r\n\r\n1. Sending stolen data\r\n2. Also victim telemetry\r\n\r\n**Meaning**\r\n\r\n| | |\r\n| --- | --- |\r\n| Args | Field |\r\n| p1 | Passwords |\r\n| p2 | Cookies |\r\n| p3 | Credit Cards |\r\n| p4 | Forms |\r\n| p5 | Steam |\r\n| p6 | Wallets |\r\n| p7 | Telegram |\r\n| p8 | ??? |\r\n| p9 | ??? |\r\n| p10 | OS Version (encrypted + encoded)* |\r\n\r\nThis is an example of crafted request performed by Predator the thief\r\n\r\n![request_beacon](:/f12b463600e2464e886c40574e2929a1)\r\n\r\n### Third step - Modular tasks (optional)\r\n\r\n```\r\n/api/Clipper.get\r\n```\r\n\r\nGive the dynamic clipper config\r\n\r\n```\r\n/api/Clipper.post\r\n```\r\n\r\nGive the predator clipper payload\r\n\r\n## Server side\r\n\r\nThe C&C is nowadays way different than the beginning, it has been reworked with some fancy designed and being able to do some stuff:\r\n\r\n1. Modulable C&C\r\n2. Classic fancy index with statistics\r\n3. Possibility to configure your panel itself\r\n4. Dynamic grabber configuration\r\n5. Telegram notifications\r\n6. Backups\r\n7. Tags for specific domains\r\n\r\n### **Index**\r\n\r\nThe predator panel changed a lot between the v2 and v3. This is currently a fancy theme one, and you can easily spot the whole statistics at first glance. the thing to notice is that the panel is fully in Russian (and I don't know at that time if there is an English one).\r\n\r\n![Predator_Panel_Index](:/c7d004fecb9f436694caae6f5321d9e7)\r\n\r\nMenu on the left is divide like this (but I'm not really sure about the correct translation)\r\n\r\n\u00d0\u0153\u00d0\u00b5\u00d0\u00bd\u00d1\u017d (Menu) \r\n\u00d0\u00a1\u00d1\u201a\u00d0\u00b0\u00d1\u201a\u00d0\u00b8\u00d1\u0081\u00d1\u201a\u00d0\u00b8\u00d0\u00ba\u00d0\u00b0 (Stats)\r\n\r\n* \u00d0\u203a\u00d0\u00be\u00d0\u00b3\u00d0\u00be\u00d0\u00b2 (Logs)\r\n* \u00d0\u0178\u00d0\u00be \u00d1\u0081\u00d1\u201a\u00d1\u20ac\u00d0\u00b0\u00d0\u00bd\u00d0\u00b0\u00d0\u00bc (Country stats)\r\n* \u00d0\u203a\u00d0\u00be\u00d0\u00b0\u00d0\u00b4\u00d0\u00b5\u00d1\u20ac\u00d0\u00b0 (Loader Stats)\r\n\r\n\u00d0\u203a\u00d0\u00be\u00d0\u00b3\u00d0\u00b8 (Logs)\r\n\r\n* \u00d0\u017e\u00d0\u00b1\u00d1\u2039\u00d1\u2021\u00d0\u00bd\u00d0\u00b0\u00d1\u008f\r\n\r\n\u00d0\u0153\u00d0\u00be\u00d0\u00b4\u00d1\u0192\u00d0\u00bb\u00d0\u00b8 (Modules)\r\n\r\n* \u00d0\u2014\u00d0\u00b0\u00d0\u00b3\u00d1\u20ac\u00d1\u0192\u00d0\u00b7\u00d0\u00b8\u00d1\u201a\u00d1\u0152 \u00d0\u00bc\u00d0\u00be\u00d0\u00b4\u00d1\u0192\u00d0\u00bb\u00d1\u0152 (Download/Upload Module)\r\n\r\n\u00d0\u009d\u00d0\u00b0\u00d1\u0081\u00d1\u201a\u00d1\u20ac\u00d0\u00be\u00d0\u00b9\u00d0\u00ba\u00d0\u00b8 (Settings)\r\n\r\n* \u00d0\u009d\u00d0\u00b0\u00d1\u0081\u00d1\u201a\u00d1\u20ac\u00d0\u00be\u00d0\u00b9\u00d0\u00ba\u00d0\u00b8 \u00d1\u0081\u00d0\u00b0\u00d0\u00b9\u00d1\u201a\u00d0\u00b0 (Site settings)\r\n* \u00d0\u00a2\u00d0\u00b5\u00d0\u00bb\u00d0\u00b5\u00d0\u00b3\u00d1\u20ac\u00d0\u00b0\u00d0\u00bc \u00d0\u00b1\u00d0\u00be\u00d1\u201a (Telegram Bot)\r\n* \u00d0\u0161\u00d0\u00be\u00d0\u00bd\u00d1\u201e\u00d0\u00b8\u00d0\u00b3 (Config)\r\n\r\n\u00d0\u201c\u00d1\u20ac\u00d0\u00b0\u00d0\u00b1\u00d0\u00b1\u00d0\u00b5\u00d1\u20ac (Grabber) \r\n\u00d0\u203a\u00d0\u00be\u00d0\u00b0\u00d0\u00b4\u00d0\u00b5\u00d1\u20ac (Loader) \r\nDomain Detect \r\nBackup \r\n\u00d0\u0178\u00d0\u00be\u00d0\u00b8\u00d1\u0081\u00d0\u00ba (Search) \r\n\u00d0\u0161\u00d0\u00be\u00d0\u00bd\u00d0\u00b2\u00d0\u00b5\u00d1\u20ac\u00d1\u201a\u00d0\u00b0\u00d1\u2020\u00d0\u00b8\u00d1\u008f (Converter => Netscape Json converter)\r\n\r\n### **Statistics / Landscape**\r\n\r\n\r\n\r\n### **Predator Config**\r\n\r\nIn term of configuring predator, the choices are pretty wild:\r\n\r\n* The actor is able to tweak its panel, by modifying some details, like the title and detail that made me laugh is you can choose a dark theme.\r\n\r\n\r\n\r\n* There is also another form, the payload config is configured by just ticking options. When done, this will update the request coming from check.get\r\n\r\n![conf](:/d6ae89d216404c28be7296b947715953)\r\n\r\n* As usual, there is also a telegram bot feature\r\n\r\n![telegram_bot](:/2cd3305fdab34c82a6de4c57bbb31542)\r\n\r\n### Creating Tags for domains seen\r\n\r\nSmall details which were also mentioned in Vidar, but if the actor wants specific attention for bots that have data coming from specific domains, it will create a tag that will help him to filter easily which of them is probably worth to dig into.\r\n\r\n\r\n\r\n### **Loader config**\r\n\r\nThe loader configuration is by far really interesting in my point of view and even it has been explained totally for its functionalities, I considered it pretty complete and user-friendly for the Threat Actor that is using it.\r\n\r\n![loader](:/29bcca5cb02e485796082eb1dea60be6)\r\n\r\n## IoCs\r\n\r\nHashes for this analysis\r\n\r\np_pckd.exe - 21ebdc3a58f3d346247b2893d41c80126edabb060759af846273f9c9d0c92a9a \r\np_upkd.exe - 6e27a2b223ef076d952aaa7c69725c831997898bebcd2d99654f4a1aa3358619 \r\np_clipper.exe - 01ef26b464faf08081fceeeb2cdff7a66ffdbd31072fe47b4eb43c219da287e8\r\n\r\nC&C\r\n\r\n* cadvexmail19mn.world\r\n\r\nOther predator hashes\r\n\r\n* 9110e59b6c7ced21e194d37bb4fc14b2\r\n* 51e1924ac4c3f87553e9e9c712348ac8\r\n* fe6125adb3cc69aa8c97ab31a0e7f5f8\r\n* 02484e00e248da80c897e2261e65d275\r\n* a86f18fa2d67415ac2d576e1cd5ccad8\r\n* 3861a092245655330f0f1ffec75aca67\r\n* ed3893c96decc3aa798be93192413d28\r\n\r\n## Conclusion\r\n\r\nInfostealer is not considered as harmful as recent highly mediatize ransomware attacks, but they are enough effective to perform severe damage and they should not be underrated, furthermore, with the use of cryptocurrencies that are more and more common, or something totally normal nowadays, the lack of security hygiene on this subject is awfully insane. that I am not surprised at all to see so much money stolen, so they will be still really active, it's always interesting to keep an eye on this malware family (and also on clippers), whenever there is a new wallet software or trading cryptocurrency software on the list, you know easily what are the possible trends (if you have a lack of knowledge in that area).\r\n\r\nNowadays, it's easy to see fresh activities in the wild for this info stealer, it could be dropped by important malware campaigns where notorious malware like ISFB Gozi is also used. It's unnecessary (on my side) to speculate about what will be next move with Predator, I have clearly no idea and not interested in that kind of stuff. The thing is the malware scene nowadays is evolving really fast, threat actor teams are moving/switching easily and it could take only hours for new updates and rework of malware by just modifying a piece of code with something already developed on some GitHub repository, or copying code from another malware. Also, the price of the malware has been adjusted, or the support communication is moved to something else.\r\n\r\nDue to this,\u00c2\u00a0 I am pretty sure at that time, this current in-depth analysis could be already outdated by some modifications. it's always a risk to take and on my side, I am only interested in the malware itself, the main ideas/facts of the major version are explained and it's plenty sufficient. There is, of course, some topics that I haven't talk like nowadays predator is now being to work as a classic executable file or a DLL, but it was developed some times ago and this subject is now a bit popular. Also, another point that I didn't find any explanation, is that seeing some decrypting process for strings that leads to some encryption algorithm related to Tor.\r\n\r\nThis in-depth analysis is also focused on showing that even simple tricks are an efficient way to slow down analysis and it is a good exercise to practice your skills if you want to improve yourself into malware analysis. Also, reverse engineering is not as hard as people could think when the fundamental concepts are assimilated, It's just time, practice and motivation.\r\n\r\n* * *\r\n\r\nOn my side, I am, as usual, typically irregular into releasing stuff due to some stuff (again...). By the way, updating projects are still one of my main focus, I still have some things that I would love to finish which are not necessarily into malware analysis, it's cool to change topics sometimes.\r\n\r\n![kob](:/059bdc1cf52e410aaa58574205694da1)\r\n\r\n#HappyHunting\r\n\r\n### Share this:\r\n\r\n* [Twitter](https://fumik0.com/2019/12/25/lets-play-again-with-predator-the-thief/?share=twitter \"Click to share on Twitter\")\r\n* [Facebook](https://fumik0.com/2019/12/25/lets-play-again-with-predator-the-thief/?share=facebook \"Click to share on Facebook\")\r\n\r\n### Like this:\r\n\r\nLoading...\r\n\r\nLast modified: December 25, 2019\r\n\r\n### Author\r\n\r\n![](:/5ab270406e5346ae8060b103fb062eeb)\r\n\r\n[fumko](https://fumik0.com/author/fumko/)\r\n\r\n### Comments\r\n\r\n### Leave a Reply\r\n\r\n## Post navigation\r\n\r\n[Previous Post Haruko Malware Tracker \u00e2\u20ac\u201c 1 Year Anniversary Update](https://fumik0.com/2019/08/27/haruko-malware-tracker-1-year-anniversary-update/)\r\n\r\n[![RSS Feed](:/44d2288d2eb440d29c33f3405f3d4a30)](https://fumik0.com/feed/ \"Subscribe to Posts\")\r\n\r\nCopyright \u00c2\u00a9 2019 **[Fumik0_'s box](https://fumik0.com)**. All rights reserved. Theme by [Mynote](https://terryl.in/).", "category": "Other", "uuid": "5e04e876-4654-422f-b2f5-507002de0b81" } ], "x_misp_comment": "Dump of the original website in Markdown format", "x_misp_meta_category": "misc", "x_misp_name": "annotation" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--44463079-3524-4cca-953b-b97690264e8c", "created": "2019-12-26T17:02:42.000Z", "modified": "2019-12-26T17:02:42.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--38108716-d461-41c6-8f58-0c2e5faa9f64", "target_ref": "x-misp-object--480d06d8-d9b8-4ced-97d8-5a1dd2b938f3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ebf1d85d-d4ce-46c7-8bc0-02dcce729d04", "created": "2019-12-26T17:02:42.000Z", "modified": "2019-12-26T17:02:42.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--7dd2b52a-6440-4cc6-9142-24b33b288eec", "target_ref": "x-misp-object--60e31b6e-033c-4edf-8e19-187bf909e409" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--03b79a82-8891-471b-ba54-c542a0acb0fa", "created": "2019-12-26T17:02:42.000Z", "modified": "2019-12-26T17:02:42.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--d4a24fd0-9810-4c54-86ba-631f43d4e22c", "target_ref": "x-misp-object--c62ace2f-f3d3-4207-be63-75b867775faf" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1cddfb38-c9a1-4d45-b009-578cd1cc3f6a", "created": "2019-12-26T17:02:42.000Z", "modified": "2019-12-26T17:02:42.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--50c3e941-eafb-46ac-9dd7-96753fea8e57", "target_ref": "x-misp-object--ecd2c5e0-2e9f-4c69-bc0c-c23961b9e132" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c7d90ae3-3479-4561-bc87-7250fbbe7421", "created": "2019-12-26T17:02:42.000Z", "modified": "2019-12-26T17:02:42.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--63aa563e-87b6-4727-808c-1f8dbd42ecf2", "target_ref": "x-misp-object--7bf812c0-54af-47f5-8085-751942a1c16c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0d04fec6-1468-4143-9b36-2ef89b4ded2e", "created": "2019-12-26T17:02:42.000Z", "modified": "2019-12-26T17:02:42.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--4dce2aca-173e-45d5-ac70-39b11b0bde68", "target_ref": "x-misp-object--f0633bef-4096-48ac-8076-42f96522515a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2e7b33f8-71be-4ed7-999b-5f8d86edd79b", "created": "2019-12-26T17:02:42.000Z", "modified": "2019-12-26T17:02:42.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--b146e56a-7421-4e1c-90a6-05e350142898", "target_ref": "x-misp-object--2a62535e-e6ab-4678-91ed-333564e64814" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--44830ce8-42bf-4353-b9df-03820469f29f", "created": "2019-12-26T17:02:42.000Z", "modified": "2019-12-26T17:02:42.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--1c1bc6e2-3c6f-4111-b421-87e1e5a05b9d", "target_ref": "x-misp-object--fd386d29-307f-462e-bd14-57bd67528cee" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }