The Predator Virus is a test release ransomware targeting users on a global scale. The currently released samples of it are early versions that may be updated in further iterations. Refer to our in-depth article for a technical analysis and full removal instructions.
|Short Description||The ransomware encrypts sensitive information on your computer system with the .predator extensions and demands a ransom to be paid to allegedly recover them.|
|Symptoms||The ransomware will encrypt your files with a strong encryption algorithm.|
|Distribution Method||Spam Emails, Email Attachments|
|Detection Tool|| See If Your System Has Been Affected by Predator |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss Predator.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
Predator Virus – Distribution Ways
The Predator virus is being distributed using a targeted campaign that appears to primarily affect English-speaking users. The security research shows that the hacker or criminal group behind are probably using the most common tactics in order to increase the number of affected users.
A common tactic is the use of phishing email messages that are made using hijacked design and elements from famous Internet sites and services. Inside of them the criminals may either embed hyperlinks to Predator virus or directly attach the virus files. They can also be used alongside download sites that use the same strategy to spread infected payloads. There are two primary types:
- Infected Documents — The hackers can construct files of various types: presentations, spreadsheets, documents and text files. Once they are opened by the users a notification prompt will appear asking them to enable the built-in scripts. This action will trigger the sequence.
- Software Installers — Using a similar technique the criminals can modify application installers of popular software: system utilities, creativity suites and productivity tools. They are constructed by taking the legitimate setup packages and modifying them with the dangerous code.
In certain situations the Predator virus can also be embedded in browser redirect code. It is primarily carried by web browser hijackers which are malicious web browser plugins that pose as legitimate extensions. They are often found on the repositories offered by the browsers themselves and are accompanied by fake user credentials and/or user reviews. The operators behind them employ descriptions that coerce the users into installing them under the disguise of new feature additions & etc.
Predator Virus – In-Depth Analysis
The initial code analysis of the Predator virus reveals that the main infection engine is not associated with any of the famous ransomware families. At the same time there is no information about the hacker or criminal group behind it which signals that it may be their invention or acquired through a hacker underground market.
The Predator virus uses a built-in infection sequence which is probably taken from one of the famous malware families. The typical behavior is to start a data gathering process which is used to extracts strings that can be grouped in two separate categories:
- User Personal Data — The malicious engine can be programmed into extracting details about the identity of the users: their name, address, phone number, interests, location and account credentials.
- Attack Optimization Data — The hackers can harvest information that can be used to update and make more effective the attack campaigns. The collected strings of this type include information such as the user’s set regional settings, operating system values and the installed hardware components.
Using the acquired information the Predator virus can then use it with another component used to bypass the security protection installed on the infected computers. This is done using an application scan that looks for signatures of anti-virus programs, sandbox environments and virtual machine hosts. Consequently their real-time engines are shut down or entirely removed.
Once the Predator virus is free to infect all system components the typical behavior is to cause various computer modifications. The most common ones include the following:
- Registry Changes — They can be done both to the operating system entries and to the user-installed applications. Common tactics are to disable certain functions and cause overall performance to degrade.
- Persistent Installation — The malicious engine can reconfigure the host system in order to make the Predator virus automatically start once the computer boots. This step also affects other processes that can be disabled. In most cases this step also involves the manipulation of the boot recovery menu —during the virus’s installation the users will not be able to access it. This creates a serious issue when using manual user recovery instructions.
- Trojan Instance — The Predator virus can be used to start a Trojan horse infection. This is done by connecting to a hacker-operated server which is used to spy on the victim’s computers, take over control of their machines and deploy additional threats.
Predator Virus — Encryption
When all components have finished execution the ransomware engine will be called. It is usually the last module that is started and like other typical infections uses a strong cipher that encrypts specific files according to a built-in list. An example victim data includes the following:
The affected files are renamed with the .predator extension. To manipulate the users into paying the hackers a proposed “decryption fee” an accompaying ransomware note is crafted in a file called README.txt. It reads the following message:
Your files were encrypted with Predator The Cipher!
Predator The Cipher v1.0
To decrypt your files:
1. Send 100$ to this bitcoin wallet: 1Pe9zG5uZFj4bGxPs98VbReXrnFayuoGf.
2. Send us email with your machine ID (XXXXXXXXXX) and bitcoin wallet ID: [email protected]
Then we would send you back our decipher tool.
DO NOT TRY TO DECRYPT OR DELETE YOUR FILES. YOU WILL ONLY MAKE IT WORSE!
Remove Predator Ransomware Virus and Restore .Predator Files
If your computer got infected with the Predator ransomware virus, you should have a bit of experience in removing malware. You should get rid of this ransomware as quickly as possible before it can have the chance to spread further and infect other computers. You should remove the ransomware and follow the step-by-step instructions guide provided below.