📝 Raw Data
Info-stealers capture a significant amount of data that is then used by threat actors to perform attacks. Hudson Rock parses the data so it can be easily provided to its clients.
To learn about Infostealers, read this 3 piece research by Hudson Rock
| File/Directory | Explanation |
|---|---|
| passwords.txt | This file contains all the URLs, logins, and passwords stored on the compromised computer. |
| UserInformation.txt | This file contains all the technical information of the compromised computer, including the computer's name, IP address, path in which the malware was installed, anti-viruses installed on the computer, operation system specifications and more. |
| Cookies | These files contain the cookies that were captured from the compromised computer, allowing threat actors to bypass traditional security measures such as 2FA by stealing the session of the victim. |
| Autofills | Contains form data automatically filled by browsers, including names, addresses, phone numbers, and other personal information that users have saved for convenience. |
| Wallets | Contains cryptocurrency wallet information, including wallet addresses, private keys, seed phrases, and wallet.dat files, enabling direct theft of digital assets. |
| Applications | Contains credentials and configuration files from installed applications such as FTP clients, VPN software, SSH keys, email clients, and messaging apps. |
| History | Contains browsing history data that reveals patterns of behavior, frequently visited sites, and potentially sensitive information about the victim's activities and interests. |
| CreditCards | Contains stored credit card information from browsers, including card numbers, expiration dates, CVV codes, and cardholder names, enabling financial fraud. |
Directory Tree of a Single Compromised Computer
BE[84B0415EF1910CC058EAE0039562018F] [2022-04-12T12_46_30.0143822-07_00]
Steam
📄 coplay_76561198437305837.vdf
📄 ssfn58921797684987530
📄 DialogConfigOverlay_1920x1080.vdf
📄 ssfn7004504802990646383
📄 libraryfolders.vdf
📄 config.vdf
📄 DialogConfig.vdf
📄 loginusers.vdf
📄 DialogConfigOverlay_1680x1050.vdf
Discord
📄 Tokens.txt
Wallets
Google_[Chrome]_Default_MaiarDeFiWallet
📄 000003.log
📄 MANIFEST-000001
📄 LOG
📄 LOG.old
📄 CURRENT
Google_[Chrome]_Default_Phantom
📄 000018.ldb
📄 000005.ldb
📄 MANIFEST-000001
📄 LOG
📄 LOG.old
📄 CURRENT
📄 000016.log
BraveSoftware_[Brave-Browser]_Default_Phantom
📄 000003.log
📄 MANIFEST-000001
📄 LOG
📄 LOG.old
📄 CURRENT
Google_[Chrome]_Default_YoroiWallet
📄 000003.log
📄 MANIFEST-000001
📄 LOG
📄 LOG.old
📄 CURRENT
Google_[Chrome]_Profile 12_Metamask
📄 000005.ldb
📄 MANIFEST-000001
📄 000028.ldb
📄 LOG
📄 000031.log
📄 LOG.old
📄 000030.ldb
📄 CURRENT
Exodus
📄 market-history-cache.json
📄 exodus.conf.json
📄 exodus.wallet
📄 seed.seco
📄 info.seco
📄 twofactor-secret.seco
📄 twofactor.seco
📄 window-state.json
📄 announcements.json
FileGrabber
Users
augus
Desktop
📄 hack.txt
📄 Amazon liste.txt
📄 PC.txt
📄 NFT.txt
📄 planning avril mai.txt
📄 comptes PrimeXBT.txt
Documents
📄 2.docx
📄 Passwords.txt
📄 UserInformation.txt
📄 ImportantAutofills.txt
Cookies
📄 Google_[Chrome]_Profile 6 Network.txt
📄 BraveSoftware_[Brave-Browser]_Profile 1 Network.txt
📄 Steam_[htmlcache]_Unknown.txt
Autofills
📄 Google_[Chrome]_Profile 4.txt
📄 Microsoft_[Edge]_Default.txt
📄 Google_[Chrome]_Default.txt
📄 BraveSoftware_[Brave-Browser]_Profile 2.txt
📄 Google_[Chrome]_Profile 7.txt
📄 Google_[Chrome]_Profile 5.txt
📄 Google_[Chrome]_Profile 12.txt
📄 DomainDetects.txt
📄 InstalledSoftware.txt
📄 InstalledSoftware.txt
Updated 4 months ago