📝 Raw Data

Info-stealers capture a significant amount of data that is then used by threat actors to perform attacks. Hudson Rock parses the data so it can be easily provided to its clients.

📘
To learn about Infostealers, read this 3 piece research by Hudson Rock

File/Directory	Explanation
passwords.txt	This file contains all the URLs, logins, and passwords stored on the compromised computer.
UserInformation.txt	This file contains all the technical information of the compromised computer, including the computer's name, IP address, path in which the malware was installed, anti-viruses installed on the computer, operation system specifications and more.
Cookies	These files contain the cookies that were captured from the compromised computer, allowing threat actors to bypass traditional security measures such as 2FA by stealing the session of the victim.
Autofills	Contains form data automatically filled by browsers, including names, addresses, phone numbers, and other personal information that users have saved for convenience.
Wallets	Contains cryptocurrency wallet information, including wallet addresses, private keys, seed phrases, and wallet.dat files, enabling direct theft of digital assets.
Applications	Contains credentials and configuration files from installed applications such as FTP clients, VPN software, SSH keys, email clients, and messaging apps.
History	Contains browsing history data that reveals patterns of behavior, frequently visited sites, and potentially sensitive information about the victim's activities and interests.
CreditCards	Contains stored credit card information from browsers, including card numbers, expiration dates, CVV codes, and cardholder names, enabling financial fraud.

Directory Tree of a Single Compromised Computer

BE[84B0415EF1910CC058EAE0039562018F] [2022-04-12T12_46_30.0143822-07_00]

Steam

📄 coplay_76561198437305837.vdf

📄 ssfn58921797684987530

📄 DialogConfigOverlay_1920x1080.vdf

📄 ssfn7004504802990646383

📄 libraryfolders.vdf

📄 config.vdf

📄 DialogConfig.vdf

📄 loginusers.vdf

📄 DialogConfigOverlay_1680x1050.vdf

Discord

📄 Tokens.txt

Wallets

Google_[Chrome]_Default_MaiarDeFiWallet

📄 000003.log

📄 MANIFEST-000001

📄 LOG

📄 LOG.old

📄 CURRENT

Google_[Chrome]_Default_Phantom

📄 000018.ldb

📄 000005.ldb

📄 MANIFEST-000001

📄 LOG

📄 LOG.old

📄 CURRENT

📄 000016.log

BraveSoftware_[Brave-Browser]_Default_Phantom

📄 000003.log

📄 MANIFEST-000001

📄 LOG

📄 LOG.old

📄 CURRENT

Google_[Chrome]_Default_YoroiWallet

📄 000003.log

📄 MANIFEST-000001

📄 LOG

📄 LOG.old

📄 CURRENT

Google_[Chrome]_Profile 12_Metamask

📄 000005.ldb

📄 MANIFEST-000001

📄 000028.ldb

📄 LOG

📄 000031.log

📄 LOG.old

📄 000030.ldb

📄 CURRENT

Exodus

📄 market-history-cache.json

📄 exodus.conf.json

📄 exodus.wallet

📄 seed.seco

📄 info.seco

📄 twofactor-secret.seco

📄 twofactor.seco

📄 window-state.json

📄 announcements.json

FileGrabber

Users

augus

Desktop

📄 hack.txt

📄 Amazon liste.txt

📄 PC.txt

📄 NFT.txt

📄 planning avril mai.txt

📄 comptes PrimeXBT.txt

Documents

📄 2.docx

📄 Passwords.txt

📄 UserInformation.txt

📄 ImportantAutofills.txt

📄 Google_[Chrome]_Profile 6 Network.txt

📄 BraveSoftware_[Brave-Browser]_Profile 1 Network.txt

📄 Steam_[htmlcache]_Unknown.txt

Autofills

📄 Google_[Chrome]_Profile 4.txt

📄 Microsoft_[Edge]_Default.txt

📄 Google_[Chrome]_Default.txt

📄 BraveSoftware_[Brave-Browser]_Profile 2.txt

📄 Google_[Chrome]_Profile 7.txt

📄 Google_[Chrome]_Profile 5.txt

📄 Google_[Chrome]_Profile 12.txt

📄 DomainDetects.txt

📄 InstalledSoftware.txt