Predator Trojan

First observed in 2018, Predator (also known as Predator the Thief, Predator the Stealer or PTST) is an information stealing trojan sold through several Russian-language dark web forums and Telegram boards. Its developers appear to be highly pro-active in adding new capabilities and offer a comprehensive control and configuration panel for use alongside Predator.

Predator, as a stealer, is considered simple and cheap. It’s good for attacking individuals and small businesses, but as far as large companies go, protection solutions and response teams can detect and remove its activity in a relatively short amount of time.

Predator has only been observed being delivered in spam or phishing campaigns, although threat actors using it may employ other distribution methods in future.

Once delivered, Predator will perform a series of checks to detect if it is running in a virtual environment. It will then attempt to escalate its privileges before beginning to collect information. Predator has the following data-gathering capabilities:

• Credential, cookie, search history and form entry extraction from most Chromium- or Gecko-based browsers, including Google Chrome and Mozilla Firefox. Newer versions are also able to extract information from Microsoft Edge and Internet Explorer.
• Credential extraction from gaming, FTP, VPN, messaging and authentication applications.
• Keylogging, although this behaviour has not been observed in the wild.
• System log and clipboard data collection.
• Webcam and microphone recording.
• Collection of WALLET and DAT files associated with most popular cryptocurrencies.

This information is then packaged into a single file, along with a unique identifier, and sent to a threat actor-specified command and control server.

Indicators of Compromise

URLs

• 15charliescene15.myjino[.]ru
• axixaxaxu1337[.]us
• j946104.myjino[.]ru
• kristihack46.myjino[.]ru
• madoko.jhfree[.]net
• predatortop[.]xyz/login

MD5 File Hashes

• c44920c419a21e07d753ed607fb6d7ca
• cf2273b943edd0752a09e90f45958c85
• b2cbb3d80c8d830a3b3c2bd568ba1826
• bf4cd781920f2bbe57e7e74a775b8e94
• dff67a78bb4866f9da5a0c1781ed5348
• 25F9EC882EAC441D4852F92E0EAB8595