873a1c01fc9e17a4762110c3d8d334857476fd2a1596ed8db14af7352eba2f24

Sharing

Copy URL Twitter E-mail

General

Target
hydralauncher-4.0.4-setup.exe
Size 172.2MB
Sample260705-ktzdmabs8v
SHA256 873a1c01fc9e17a4762110c3d8d334857476fd2a1596ed8db14af7352eba2f24
MD5 368dc1112cd37889eaef231aefa45dc6
SHA1 80a2c903b79364c52b071c2fddfe25e98186eed5
SHA512 a775cf94e6757334ed9fe7c45e401bf2cf2e5463384c800a8b77817509bf90ff6467f2894d0582b34b6c8df0d44e850a621a86a714329fb652de40fde20dd1de
SSDEEP 3145728:cS2YaHElOe242pa6JzZaoFApB5ymZusMfeLebG7g6bgdC+4pkQorEnrWzoQG:8YR4DpaYaycMY/EdCpSQorroJ
TLSH
T107883308122A6E5BC8DD9AB145214B685AC21FBD4C87C7DB7B6338570E357CCB3B6923
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  hydralauncher-4.0.4-setup.exe
- Size 172.2MB
- SHA256 873a1c01fc9e17a4762110c3d8d334857476fd2a1596ed8db14af7352eba2f24
- MD5 368dc1112cd37889eaef231aefa45dc6
- SHA1 80a2c903b79364c52b071c2fddfe25e98186eed5
- SHA512 a775cf94e6757334ed9fe7c45e401bf2cf2e5463384c800a8b77817509bf90ff6467f2894d0582b34b6c8df0d44e850a621a86a714329fb652de40fde20dd1de
- SSDEEP 3145728:cS2YaHElOe242pa6JzZaoFApB5ymZusMfeLebG7g6bgdC+4pkQorEnrWzoQG:8YR4DpaYaycMY/EdCpSQorroJ
- TLSH
  T107883308122A6E5BC8DD9AB145214B685AC21FBD4C87C7DB7B6338570E357CCB3B6923
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  resources/hydra-python-rpc/lib/urllib/__init__.pyc
- Size 158B
- SHA256 bbb677da39f255189044d9e2b467e5b9f182f29f0f5b6a1c918d7784459bbfff
- MD5 89291bae25f3842a8298dee049b0048e
- SHA1 e1a6d2e3fc473471baa416dff4ca2543e647c3f1
- SHA512 acbb52dfa1d1d535881a55d04db62cea37b73080aa6a6788927cc44bde409fb4299905be20151217dff1cb36e366ba1fe26a67808aedf8a6b49138019ee14209
- TLSH
  T177C02B044B53C193F47FB532712D230810C8CE4071C60453084D72042C0C6010E30810
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  resources/hydra-python-rpc/lib/urllib/parse.pyc
- Size 34KB
- SHA256 c54eb9133433c10e14440532a58ae3f98c455e547d67d183245ad7e7c0b7f6af
- MD5 36758ac3dd226898c12681486b9fe10e
- SHA1 0d31e57f8c73834eb23377b7197695ca547f4f96
- SHA512 b0be5f1abc192535a430bd889d78d1cdb868719c3c70ce4d8bd1ca472ac19db6db4e126c82cafc0f58f516e0b22d12e5721b0cc92e362261dd6137ca575b9771
- SSDEEP 768:YjxQ4XLRMZ+VZcqeMKRvpFGdrGu2JkDkNyS3qrvLtJ6aRO8Ac:SxQyfY6EtkbRdb
- TLSH
  T1B5F239A23A913916FD61F2F0B43E42145F7893B7631552E2B81CD2AE3F099C49C738DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  resources/hydra-python-rpc/lib/xml/__init__.pyc
- Size 720B
- SHA256 e5c227c80f11a4ef7d9162b38f612260ab2e3daebd1d979f06e151be254cda44
- MD5 2a1024e1daa136ad68f9e8dcd1f3cc49
- SHA1 1d034040400ec480df334942c70ee2deab20d7d2
- SHA512 752ab22eb30b069b1a9a7140d6620ef15e9a417cbd3025756235cc182ccff52b4c383422a2db045454974242809f5841048d87d6d016e2e6345840782a1a4f71
- TLSH
  T1010144301152E2B3D73F4A3D3D0D22D359584D7C3357C496706C53641B056398AB3C50
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  resources/hydra-python-rpc/lib/xml/parsers/__init__.pyc
- Size 335B
- SHA256 22091e9bfd53a8da0db2224ff247102faaf913cbdc97cae1ccdd04e61f38e7c2
- MD5 4506e12a11624e014647de0e9c89423c
- SHA1 03a5026a6b5bdffbad501ee96fdf580532345593
- SHA512 de1a8a0ea6401942589017046eb20ba98d84160e005b3c936cfa126e8f11192f6c04cf7ee3c72a960713f8d7ada6f8a013ec02d8b0885f085bdd0352586c0735
- TLSH
  T1E3E07D105961E527D02B72BFE51F3A3C38D5943063904111385C22D46F496B58D63518
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  resources/hydra-python-rpc/lib/xml/parsers/expat.pyc
- Size 364B
- SHA256 9f3ad7d3a38ebab23ccd17f632ad192ffc2ed4ec8fac27b0d14454b59b4cdc32
- MD5 47d19e37e623b9ab3b0f20699cdbc7bc
- SHA1 e830e9fbbb41230b3fd3dd4a90e00999c99dd58e
- SHA512 8a8d4fb1ffbd761a104fc5a784877b799dacddd1b7b852455e0b45de591cb6b816efc54416026c267395149ceecad9192790d8ea383a36d84c3b453335217bbc
- TLSH
  T105E026640892DE72D86F1AFDBD6E627535C11DC81A8481373F1C560A7D19EE84CB2694
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  resources/hydra-python-rpc/lib/xmlrpc/__init__.pyc
- Size 158B
- SHA256 b64456239860a1aa30530fb398757379e2bffe09e7baf2fcfbc8ea055ebaf954
- MD5 7c95cb8ddbd0332f9cee9358e1bad03d
- SHA1 d6c63c5d8e1add9032abda84073c09500d28ea02
- SHA512 110808b61e4dc2583e1451627d0322949275f920096348a58d2c71b40b99526729e70bfc6bba4a0ed4d4d83a75c5a1b92c9e6ec4f944be7fe431fce712a10469
- TLSH
  T1C3C02B0C4713C1A3F07FB635B52E670824CCCE0071CA00230C0C73042C0C2010D21410
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  resources/hydra-python-rpc/lib/xmlrpc/client.pyc
- Size 33KB
- SHA256 1ed1320cb47d677e693ef3657fb734228a54f5a9a31cadc0a922282fe18088aa
- MD5 409a8bd241413cf62c50e9a4d4fcf28c
- SHA1 799b677712f1b04c73b34d834e55a15352f92aa5
- SHA512 4eaa47838226b971324a29e2c90fc7187fd4faf8c807517b91c8473f679653da3b90fce786fa234575e6f593eb4963d055e3395669420449f8f219cddf8e17bc
- SSDEEP 768:O2qvGqfqaqqmqq4WJqDqqssAX/qoqc7mqHtgqNNq0q3q4q1q2qmqCquxbqq/qNoQ:O2quqfqaqqmqq1JqDqqssAX/qoqc7mqQ
- TLSH
  T16FF2B3C1A649BEAFFD7DF3BC40990220B2289337274A94677139816E3FC76D85D3158A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  resources/hydra-python-rpc/msvcp140.dll
- Size 561KB
- SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
- MD5 72f3d84384e888bf0d38852eb863026b
- SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
- SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
- SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
- TLSH
  T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/hydra-python-rpc/python3.dll
- Size 59KB
- SHA256 5a2f39ed041d35bb48e89c72c1ad16a5a24a3674f8eb34bfbc6310fd75128f16
- MD5 4a776941c0aa723c50223cb1a19e6d02
- SHA1 08e4cdf06f3b9ee5f9d5c865b49c808d20938583
- SHA512 0319030bd2b51bf605c8ef4324eacf3a1f2e2315c92bc0cfc8e9eb7df72038f6c377b9537fec16470363499e6e0dbb7ca164169ae43601294310f84e53a06881
- SSDEEP 768:Kn+mYEBMcEfpzVHBlAUcfc0la6Wc6kH/ZFJ1Yu+wNBECaOMyCgUhkb0E/GhJIWQi:K+mYEBMofwkAJIWQ077SybdR
- TLSH
  T19C5380525894FCA3DBEA2DFF78D19DC914E912CC812684DCB97892930F5A233AD2734D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/hydra-python-rpc/python39.dll
- Size 4.3MB
- SHA256 324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3
- MD5 2135da9f78a8ef80850fa582df2c7239
- SHA1 aac6ad3054de6566851cae75215bdeda607821c4
- SHA512 423b03990d6aa9375ce10e6b62ffdb7e1e2f20a62d248aac822eb9d973ae2bf35deddd2550a4a0e17c51ad9f1e4f86443ca8f94050e0986daa345d30181a2369
- SSDEEP 49152:icfsV4WJ+NXBzGcS5V7Du7RHEYNf/OpEQZIMKKx+qNIowg1h9MKpj4ZkYMCfmUIS:6JeB1SDaZf/7Ns9MLZfERUHRMXIwNKX
- TLSH
  T1D3267C22A3941194DAB78477C5278746DBF2FC502B20E34B41A4BAD52F73BA316EF706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/hydra-python-rpc/ucrtbase.dll
- Size 1.3MB
- SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
- MD5 286b308df8012a5dfc4276fb16dd9ccc
- SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
- SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
- SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
- TLSH
  T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  resources/hydra-python-rpc/vcruntime140.dll
- Size 117KB
- SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
- MD5 caf9edded91c1f6c0022b278c16679aa
- SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
- SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
- SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
- TLSH
  T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Enumerates processes with tasklist

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32