Predator the Thief

36
Global rank
45
Month rank
40
Week rank
5995
IOCs

Predator, the Thief, is an information stealer, meaning that malware steals data from infected systems. This virus can access the camera and spy on victims, steal passwords and login information, and retrieve payment data from cryptocurrency wallets.

Stealer
Type
ex-USSR
Origin
1 July, 2018
First seen
30 May, 2023
Last seen

How to analyze Predator the Thief with ANY.RUN

Stealer
Type
ex-USSR
Origin
1 July, 2018
First seen
30 May, 2023
Last seen

IOCs

IP addresses
13.248.148.254
141.8.192.31
103.224.182.253
141.8.192.151
103.224.212.222
185.26.122.20
185.50.25.11
185.107.56.195
217.107.219.142
81.177.141.22
185.178.208.190
141.8.197.42
5.101.152.59
192.64.119.216
5.79.66.145
185.50.25.7
178.208.83.43
81.177.141.33
141.8.194.74
81.177.135.112
Hashes
35296aa729a0a7ffb94e8141ef9de20315f88412d1c68dbb81fbae5fa871f914
21c082d4996ce353c425b3c521bb944712a120f53d871871fb59b072002b0bf2
1d9608473e0ef07ace0bd32fdecdda072a798103c65c25fe6dfa037e9cf1ad38
fbbfa38a2600deddb5843fa4b43b9a0a3dc8a80ea97edcc94611f665224d6373
435ef2a176e29325afeab850ec3952871fc59147ac34b86ab1283cbfcc54339a
d6aa8b9d84c3c090fe5c49de4472ba80f70e2a7f8bdae5c013596b9b2f7a2248
46ed7ad82d35a06e8b4f8e7a71cca0edbc42af11e2c84aa2d9de28cfbd3afa44
18f15569472c095e39198171fa1f4f15a3bcb8d272e74a0fa8cf1052aeabaf28
03394bb685086deb23a859ca747a2f475edcfdf32c936f4fbfdfb7822a89f3b4
bf5df673231113d79572a36fe4a81bc2afd0ad5c12c9ffc9f4b660c1f8c3f478
ea856e03008148b081933f3628440d145fcbebe242dbdc4d5e96b8fb5f55640e
b84df003f96728caa8e8e8a54a2ab1a074a6d7b5666ec0aa36c468d3579174d5
8cb11e9ea3a9d2f337de555121723424665fec7bfe1b2bc859abe0d2b13d10c2
8bdbe85ae0d8a6a3ee7b16e71a3daf2efec034a378b21cdff2f739bdb0729620
fb8bce463284f205dbf497bffd6aedbe7791d5b9f963d62349e55cb4eccade4a
6e1927da1497ac8253b75fee41a85d3555d9f69a7f37efad6ed81a8f4858f648
a3533e8f60ed7f0ef65823a3f1b4db9900852adde2b4bee45d695442c313b06a
28e25eb0416b6324e5a643700d1ae70f464f6150c73e84d078d0b096340b5c80
138dcd3d3c2a2f505ea7511bbdd901a0dfb8e998207d8868b375fbf8543616d4
ec042ea8b6b6a94678df7612bffa69082e772b6c9d8a57b0bc89bc1258046b80
Domains
gabriellalovecats.com
www.20mbweb.com
www.worldforumdisrupt.com
img.rating-widget.com
rating-widget.com
secure.rating-widget.com
js.rating-widget.com
css.rating-widget.com
elx01.knas.systems
majul.com
ww1.gmai.com
a0698649.xsph.ru
a0651049.xsph.ru
qxq.ddns.net
726512.parkingcrew.net
a0447444.xsph.ru
a0438890.xsph.ru
a0437968.xsph.ru
a0437885.xsph.ru
rniiis.ru
Last Seen at

Recent blog posts

recentPost
How to Create a Task in ANY.RUN:a Step-by-Ste...
watchers 307
comments 0
recentPost
ChatGPT for SOC and Malware Analysis professi...
watchers 5383
comments 0
recentPost
Deobfuscating the Latest GuLoader: Automating...
watchers 3236
comments 3

What is Predator the Thief?

Predator the Thief is an information stealer type malware, which attackers use to collect information from infected machines. Predator trojan can steal passwords, information from crypto wallets, access the camera to collect visuals of a machine owner and more.

As ransomware and other malicious programs from the stealer class, Predator the Thief is a somewhat basic program that hasn’t changed much since it’s the first version developed by a user named Alexuiop1337 around July of 2018. Bearing this in mind, this malware does not pose a significant threat to most corporations with adequate cybersecurity measures but can devastate careless private users.

General description of Predator the Thief

Researchers believe that Predator the Thief was developed by Russian-speaking malware actors as it mostly appears for sale on Russian forums where the malware could be obtained for a meager price of around $30. At the moment of publication, the price has risen to $150. With every purchase, clients obtain a builder and everything they need to host attacks. Malware authors themselves are known to distribute the builder but haven’t been witnessed generating any direct attacks.

An individual first promoted the malware with an alias “Alexuiop1337” who is still actively spreading information about the virus. However, at one point, he has taken up another name — “Kongress_nlt.” There is also a known telegram user, “sett9” who is affiliated with the operation and could be the “Kongress_nlt” himself. It is known that “sett9” is active on Telegram. Furthermore, one can follow the latest news concerning Predator on a dedicated Telegram channel, “@PredatorSoftwareChannel,” which lists all updates to the malware.

And the authors do, in fact, frequently update the malware and introduce new functions and undetectable samples to avoid discovery. In addition, they are willing to set up backend administration cabinets for clients for an extra fee. Notably, one of the updates has reworked the code from the ground up to make Predator what they call “fileless.” This means that when running, the malware doesn’t leave any files on an infected machine, making it that much more difficult to detect. This allows the stealer to operate stealthily under the hood of a clueless victim and inflict more damage over time as more potentially sensitive data is stolen.

When it comes to data-stealing, concerning browsers Predator the Thief focuses mainly on Chrome, Opera, and Firefox-based programs and uses “industry-standard” techniques to do its job. The malware can also mess with wallets for the following cryptocurrency:

  • Ethereum
  • Multibit
  • Electrum
  • Armory
  • Bytecoin
  • Bitcoin
  • And others…

As well as pull data from Filezilla and WInFTP. Another trick that Predator has up its sleeve is an anti-VM check that instantly terminates the execution of the malware detects that it is being launched on a Virtual Machine. This feature is there to complicate the analysis as much as possible and slow down research.

However, despite these functions, and although Predator can steal data from many sources the same as ransomware, it is still considered a relatively primitive malware compared to some other stealers. Not surprisingly for its well affordable price. However, while the punch that it packs may not be enough to shatter the defense of most modern large-scale corporations, small businesses and individuals can still suffer serious damage from Predator attacks.

Predator the Thief malware analysis

A video recorded in the ANY.RUN malware hunting service displays the execution process of Predator the Thief, allowing one to examine it in a convenient and safe environment.

process graph of predator the thief execution

Figure 1: Displays the dynamic graph of processes generated by the ANY.RUN malware analyzing service.

text report of the predator the thief analysis

Figure 2: Even more information about the execution of malware can be found in this customizable text report generated by ANY.RUN.

Predator the Thief execution process

Predator's execution process is quite straightforward the same as Qbot and Netwire. After the stealer starts execution, it instantly begins stealing information from the system. Stolen information is then being written into files which are later compressed into a single archive. After that, Predator sends the compressed file to its Command And Control server. When the file is sent, the malware terminates the execution and sometimes deletes itself.

Distribution of Predator the Thief

Predator trojan gets into the machines of its victims disguised as a harmless document. It may enter the machine in a .ZIP file which contains an executable disguised as a document or useful program with a name that tricks the potential victim into interacting with it.

In other cases, the malware utilizes the vulnerability in the UNACEV2.dll library of WinRAR. In this case, the victim is being presented with multiple .PNG, which is to hide the fact that the malicious file is placed in the startup folder, which will be executed with the next system reboot or launch. Also, Predator The Thief distribution is a common method through links to legitimate websites such as cdn.discordapp.com, raw.githubusercontent.com, and others.

How to detect Predator the Thief using ANY.RUN?

Some malware creates files in which it named itself. Often you can find such info about Predator the Thief using ANY.RUN's "Static Discovering." Open either the "Files" tab in the lower part of the task's window or click on the process and then on the "More Info" button in the appeared window. After that, all you need to do is click on the "Information.txt" file.

predator the thief static discovering

Figure 3: Static discovering of the file "Information.txt" created by Predator the Thief

Summary

Predator the Thief may not be the most complex information stealer on the planet. It is also one of the cheapest options currently on the market. Despite that, the authors of this malicious program show a strong dedication to their business and spend a lot of time and energy producing meaningful updates, marketing their creation in underground communities, providing set-up services, and building admin panels upon request. This above all leads to the fact that Predator is becoming a more and more popular stealer and dangerously accessible.

Bearing in mind that most attack vectors involved documents structured around business topics, small company owners are at the biggest risk since cyber defense is sometimes lacking in smaller companies.

To help the situation and make this threat less dangerous, cybersecurity researchers can use the tools ANY.RUN malware hunting service provides to professionals and students to crack the code of Predator the Thief. ANY.RUN streamlines the malware analysis process and enables to complete research projects faster and more efficiently without compromising the quality of results. Hopefully, together we will mitigate the threat posed by Predator and other similar information stealers and ransomware as well.

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control the PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server.
Read More

Our website uses cookies. By visiting the pages of the site, you agree to our Privacy Policy