Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3hydra-5.4-....8.dll
windows7-x64
3hydra-5.4-....8.dll
windows10-2004-x64
3hydra-5.4-....8.dll
windows7-x64
3hydra-5.4-....8.dll
windows10-2004-x64
3hydra-5.4-...n1.dll
windows7-x64
3hydra-5.4-...n1.dll
windows10-2004-x64
3hydra-5.4-...ra.exe
windows7-x64
1hydra-5.4-...ra.exe
windows10-2004-x64
3hydra-5.4-...or.exe
windows7-x64
1hydra-5.4-...or.exe
windows10-2004-x64
3Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 03:24
Static task
static1
Behavioral task
behavioral1
Sample
hydra-5.4-win/cygcrypto-0.9.8.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
hydra-5.4-win/cygcrypto-0.9.8.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
hydra-5.4-win/cygssl-0.9.8.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
hydra-5.4-win/cygssl-0.9.8.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
hydra-5.4-win/cygwin1.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
hydra-5.4-win/cygwin1.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
hydra-5.4-win/hydra.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
hydra-5.4-win/hydra.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
hydra-5.4-win/pw-inspector.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
hydra-5.4-win/pw-inspector.exe
Resource
win10v2004-20240802-en
General
-
Target
hydra-5.4-win/hydra.exe
-
Size
180KB
-
MD5
a372454727710bfdd4950dcfac4c89a4
-
SHA1
aeddc1b7dd82946ff5b95ce18f7df685bc466354
-
SHA256
a7eb5c2418100a04c93570fa91dffe320d859540b67005f53b1540641b41f790
-
SHA512
c3c770118f75f9d5985e6d11107426f11fcdfe5a3f3e2538091c21f9a3b53cc42240e4f2b31268251e571a4abb5da980b8912fdfb5bcc5bfc17f87f84040029d
-
SSDEEP
3072:mFqQ/UDrOHdks7DNLgo/PmnpurOOrrVXi03YsetlL+xROIzs22+zionA5lei:LIH5PYBroROP2mzei
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeCreateGlobalPrivilege 600 hydra.exe Token: SeChangeNotifyPrivilege 600 hydra.exe Token: SeRestorePrivilege 600 hydra.exe Token: SeChangeNotifyPrivilege 600 hydra.exe