hydra[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

hydra.exe
Size

432KB
MD5

9b4fca18ba3df92ea7856b794da91889
SHA1

598114cd649f81ea19019013a1367075458ce1d5
SHA256

ee43a7be375ae2203b635c569652f182f381b426f80430ee495aa6a96f37b4e6
SHA512

7674f9cd608f15e0e546c4a6d66520430b4922284231e652ea04ba1b14c99a30dceff45b428d1d67f5958e4236f139bf5222a3bfeb80b7fd956182cb99f562d5
SSDEEP

6144:CEllLg6Sbe0KfuazLbFtQupCudN+JU7WwyoLsnL4CUNfeKuwl2YWilq:CEzgex5JtHpCudN+m7WPoLYkPNhC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
hydra.exe

Files

hydra.exe
.exe windows x64

da06c4f8eba1a1dd054517a8c5d68e6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

cygcrypto-1.1

BN_free
BN_new
BN_set_word
DES_ecb_encrypt
DES_key_sched
DES_ncbc_encrypt
DES_set_key
DES_set_odd_parity
ERR_error_string
ERR_get_error
EVP_md5
EVP_sha1
HMAC
MD4_Final
MD4_Init
MD4_Update
MD5_Final
MD5_Init
MD5_Update
PKCS5_PBKDF2_HMAC_SHA1
RSA_free
RSA_generate_key_ex
RSA_get0_key
RSA_new
RSA_size
SHA1
SHA1_Final
SHA1_Init
SHA1_Update
SHA256_Final
SHA256_Init
SHA256_Update

cygwin1

__assert_func
__cxa_atexit
__errno
__getreent
__locale_ctype_ptr
__main
__memcpy_chk
__sprintf_chk
__stack_chk_fail
__stack_chk_guard
__stpcpy_chk
__strcat_chk
__strcpy_chk
__strncat_chk
__strncpy_chk
_dll_crt0
_exit
_impure_ptr
alarm
atoi
bind
calloc
close
connect
cygwin_detach_dll
cygwin_internal
dll_dllcrt0
exit
fclose
fcntl
fflush
fgets
fileno
fopen
fork
fprintf
fputc
fread
free
freeaddrinfo
fwrite
getaddrinfo
getenv
getopt
getpid
getsockname
gettimeofday
getuid
index
inet_addr
inet_ntoa
inet_ntop
isatty
kill
localtime
malloc
memcmp
memcpy
memmove
memset
nanosleep
optarg
optind
perror
posix_memalign
pow
printf
putchar
puts
rand
random
read
realloc
recv
rindex
select
send
setvbuf
signal
sleep
snprintf
socket
socketpair
sprintf
sscanf
stpcpy
strcasecmp
strcat
strchr
strcmp
strcpy
strdup
strerror
strftime
strlen
strncasecmp
strncmp
strncpy
strndup
strrchr
strstr
strtok
strtoul
time
tolower
toupper
unlink
vsnprintf
wait3
write

cygfreerdp2-2

freerdp_connect
freerdp_context_new
freerdp_disconnect
freerdp_free
freerdp_get_last_error
freerdp_get_last_error_string
freerdp_new

cyggcrypt-20

gcry_check_version
gcry_cipher_close
gcry_cipher_encrypt
gcry_cipher_open
gcry_cipher_setiv
gcry_cipher_setkey
gcry_md_close
gcry_md_open
gcry_md_read
gcry_md_reset
gcry_md_write
gcry_strerror
gcry_strsource

cygidn-11

pr29_8z
stringprep_profile

cygmariadb-3

mysql_close
mysql_errno
mysql_error
mysql_init
mysql_real_connect

cygpcre-1

pcre_compile
pcre_exec

cygpq-5

PQconnectdb
PQfinish
PQstatus

cygssh-4

privatekey_from_file
ssh_auth_list
ssh_connect
ssh_disconnect
ssh_finalize
ssh_free
ssh_get_error
ssh_init
ssh_is_connected
ssh_new
ssh_options_set
ssh_userauth_kbdint
ssh_userauth_kbdint_getnprompts
ssh_userauth_kbdint_setanswer
ssh_userauth_list
ssh_userauth_none
ssh_userauth_password
ssh_userauth_pubkey

cygssl-1.1

OPENSSL_init_ssl
SSL_CIPHER_get_name
SSL_CTX_new
SSL_CTX_set_default_verify_paths
SSL_CTX_set_options
SSL_CTX_set_verify
SSL_clear
SSL_connect
SSL_ctrl
SSL_get_current_cipher
SSL_get_fd
SSL_new
SSL_pending
SSL_read
SSL_set_bio
SSL_set_fd
SSL_write
TLS_client_method

cygwinpr2-2

WLog_GetRoot
WLog_SetStringLogLevel

cygz

crc32
gzclose
gzdopen
gzeof
gzgets
gzrewind

kernel32

GetModuleHandleA

Sections

.text
Size: 281KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 53KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 50B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

da06c4f8eba1a1dd054517a8c5d68e6d

Headers

DLL Characteristics

File Characteristics

Imports

cygcrypto-1.1

cygwin1

cygfreerdp2-2

cyggcrypt-20

cygidn-11

cygmariadb-3

cygpcre-1

cygpq-5

cygssh-4

cygssl-1.1

cygwinpr2-2

cygz

kernel32

Sections

.text Size: 281KB - Virtual size: 280KB

.data Size: 4KB - Virtual size: 4KB

.rdata Size: 84KB - Virtual size: 83KB

.buildid Size: 512B - Virtual size: 53B

.pdata Size: 5KB - Virtual size: 5KB

.xdata Size: 7KB - Virtual size: 6KB

.bss Size: - Virtual size: 53KB

.edata Size: 512B - Virtual size: 50B

.idata Size: 8KB - Virtual size: 8KB

.rsrc Size: 39KB - Virtual size: 38KB

.reloc Size: 1024B - Virtual size: 648B

.text
Size: 281KB - Virtual size: 280KB

.data
Size: 4KB - Virtual size: 4KB

.rdata
Size: 84KB - Virtual size: 83KB

.buildid
Size: 512B - Virtual size: 53B

.pdata
Size: 5KB - Virtual size: 5KB

.xdata
Size: 7KB - Virtual size: 6KB

.bss
Size: - Virtual size: 53KB

.edata
Size: 512B - Virtual size: 50B

.idata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 39KB - Virtual size: 38KB

.reloc
Size: 1024B - Virtual size: 648B