736883e8afbc7e129876056d4ba78966c910c19ba3f882ea352b4709d224df26

Sharing

Copy URL Twitter E-mail

General

Target
hydralauncher-4.1.1-portable.exe
Size 176.7MB
Sample260814-mlbcyahb59
SHA256 736883e8afbc7e129876056d4ba78966c910c19ba3f882ea352b4709d224df26
MD5 49bc171117d235a1689b18cdee2ac881
SHA1 58097a350962c5f40de3498b2feb4df2423ff016
SHA512 e9474de1260aeb3d47c0f2bb4d1927f8f03b6b2e9755a709737e7e59d0d848771324f2a96e1f93349c4e9747cd7d851f6a441287c02970887665efb15970e4b3
SSDEEP 3145728:E2YaHElcP0vm54QgHXcJUA68QpeLebG7g6bgdC+wpkQorEprWzo47:PYRHvma9AKY/EdCDSQorVos
TLSH
T11498339852167A53CCDCA470506A0B901A472FFD88A3CBD3BB1778D70D79B9C93BB912
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  hydralauncher-4.1.1-portable.exe
- Size 176.7MB
- SHA256 736883e8afbc7e129876056d4ba78966c910c19ba3f882ea352b4709d224df26
- MD5 49bc171117d235a1689b18cdee2ac881
- SHA1 58097a350962c5f40de3498b2feb4df2423ff016
- SHA512 e9474de1260aeb3d47c0f2bb4d1927f8f03b6b2e9755a709737e7e59d0d848771324f2a96e1f93349c4e9747cd7d851f6a441287c02970887665efb15970e4b3
- SSDEEP 3145728:E2YaHElcP0vm54QgHXcJUA68QpeLebG7g6bgdC+wpkQorEprWzo47:PYRHvma9AKY/EdCDSQorVos
- TLSH
  T11498339852167A53CCDCA470506A0B901A472FFD88A3CBD3BB1778D70D79B9C93BB912
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app-64.7z
- Size 176.2MB
- SHA256 d5a00b33f69504c87fa00f033704d2bec1da1204e3ee80a0fe461c237114c502
- MD5 a72c11326d4e87569456f6312c550c3a
- SHA1 c14db15c6a5faba3c6827ffc6da343023836bf45
- SHA512 c371b472ecdae55f79d64ff43084e4d264a63630189b313b51c7979c2151395d40bf2a0b7341942f3c29e4d4039096ebfe3e5b33a8fd989dc4231cbc7043df2b
- SSDEEP 3145728:T2YaHElcP0vm54QgHXcJUA68QpeLebG7g6bgdC+wpkQorEprWzo+:yYRHvma9AKY/EdCDSQorVo+
- TLSH
  T1FD9833AC63167B53DCD0A470606A0B902A4737DECCA08DA79B659CD40179DECD3FBA27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  resources/hydra-python-rpc/lib/multiprocessing/reduction.pyc
- Size 8KB
- SHA256 e5533e15dd1e30b2611b9139e610f5280fbc3541970ac02d9ae8a63ff1f5f6b8
- MD5 1066f9767fbe4fc0c113bdaba836dcbe
- SHA1 601726c8aa0c7e12645a0bda56e4700c73a27a18
- SHA512 4c60fa5f92408c3ca5991afa49a2c7b790e0e057b8f7ccce70e620ee02a0f170665472a9ad41c988d8cae950a622bd619ce1aff2e4298abace4fe81ef304d48b
- SSDEEP 96:Knx0UviKWKzNb5GteBYvX82jHgSROYetd5k5UQj9o1ZzGSZ+bRiV29r+vlhJuGHq:jzKWKV5Gt/vXAou5k5UQRoLGE7iFfmPu
- TLSH
  T1040283C1D68A2E5EFC72F3BC10295F502356E32A630D9363D504A22E2D9D5C45DB1AAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  resources/hydra-python-rpc/lib/multiprocessing/resource_sharer.pyc
- Size 5KB
- SHA256 5f3effbb6fc753e891ac84c14141aecbabaef2dc164b2e09fff586ae586b47ed
- MD5 d6c3ee4e01c8ddda8d04fd2a6b8770d2
- SHA1 47462630821e5daaedfb52a11ee81004b4cde4d9
- SHA512 c0f070b7d4d9a66f02f9fb217578df2fa9a20050a5847a103b7178bcda1161225db41804f91efc0de5c12e324e5c88b7b7315992fb335c2b1589bb5ace1bd8ff
- SSDEEP 96:hs/kkHYzYnYa1m/hxdcehnUyiaqA2JZicd1D0uGbmz32UhLpp0Oh+RVoQ31Dfzrw:hssk40nYwm5xdceNUHaqbd1D0uGbmzXP
- TLSH
  T142B1CAD3EE5A997BFE71F275E42F1300212A5321B3589617C910F19B1E8B3D10D74A88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery execution spyware
behavioral11 behavioral12
- Target
  resources/hydra-python-rpc/lib/multiprocessing/resource_tracker.pyc
- Size 5KB
- SHA256 4da04d815f15abb28ba74fd6f9399a4bbee4c59b57a95d870053d2fc754ab6b7
- MD5 93fb0b53a4a9650d11a35ae2a1ced7d6
- SHA1 a9e8dacd74ac16fe16819d56b5cf30afc0c3124e
- SHA512 2f138a88c10def78cb45690b4a3fa27029c39c87eb787d0bf585034a41f5985b6a2464ba94a7ea10e8eb339d5b7d8100ee3a0e7783a82b25dfba64b3787ca213
- SSDEEP 96:SKx220Lq4i57qeq0ndUdURPqf8VVjuqfMcWZ/QqMCrPL/ZSUS8GZ1qq6/bbfcVGA:Fx0q4gqeqgCUBAIluqfMcWZ/QqMw7TR2
- TLSH
  T157B1B5EBD2C991F3F8B4F1BD2069033086DEA53963684456F52AB1152FEF2C05979D88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  resources/hydra-python-rpc/lib/multiprocessing/shared_memory.pyc
- Size 14KB
- SHA256 5f256ad799b736ba5ce18c27095068bc8b1b8492e0cebddcfb831a2556a09ffa
- MD5 d81c75ce7d76a8b0e6225cac2742e3dd
- SHA1 5a3498d8c6cadc87473ba788faf19605ea722bf7
- SHA512 6ca7b5873cde06f68cb78742a0c54eaed84b30feeca5e686a1c3d0544d6ef66d0c4d917e8e8fa90b0005dfce5e8e6656f0c675dbc8c161fa7fe524a209f500ee
- SSDEEP 384:+nkxC1DweJqfQUcZNivZmU9ZSP+9XEUo0fGvs5+dPJPdvx791dMbz0Yl/5zpSmVL:+nf1DweJqfQUcXymU9Z0SXEcOvs5aRVc
- TLSH
  T14A52C7D2AA6D0CABFCE5F2B9A4D723947B28C23B13145D837009D06F1F445A42DBDE99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  resources/hydra-python-rpc/lib/multiprocessing/sharedctypes.pyc
- Size 6KB
- SHA256 a71e923b3c50d7ab4cd9353051988d11da02275372245b02bc571bfb0b880194
- MD5 e821d58c8fa42c1ef6b71d2cf91ad545
- SHA1 b2108cc8a14303ac3d2a9ad16496b85308caa50c
- SHA512 7b4d92a2357102226eb84e1dc4ea3a28f3e2b50e4faebfd8a7aea38cb77e27085d449297b30c0964f350e05c158734c8bc9f85285b0b5c12120d80b1149ab7b7
- SSDEEP 192:r7KMWxEMBb4zMSoSN3lnpR96chY/dP5Tr:lWxRBUzMSoinn4dRP
- TLSH
  T19FE165C3E69A2A4DFC77F2B95C6703205B599233220C7427700A90DB1E5D1DFCC69E69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  resources/hydra-python-rpc/lib/multiprocessing/spawn.pyc
- Size 6KB
- SHA256 3e8d32f6f5778fb5565095ef34b611a6e87e000ae818d5d890e2814f9ec4af6f
- MD5 f1222734e554ee7b9a7e2f5dcf445be0
- SHA1 e9fddd136f1b0f9938730d8e665eae731e0f9c6c
- SHA512 3b71973b07a38f4dab6e1646fc71e80c97c2a83ea60e84075acc91a366f427aa45187164b0e67289826f31088f8b32217b147960746ece6b6329cc5fd5c2aad3
- SSDEEP 96:bP+XaLec9St+mzppYztjfAfRuZPym919iMwpyTQW1UUg/J4CurxqVICZi:bpqiS4mVaz2ga0IpyTQYYFurkCKi
- TLSH
  T147D1B447E1556496FEE4F6BCB0152A206BA5F3A7238A4103795CE05B0FC93904EBA78D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  resources/hydra-python-rpc/lib/multiprocessing/synchronize.pyc
- Size 11KB
- SHA256 d97358257b7888d4e8c8d4c58837a617eee2c0b32b640f6a53a93fa2572ae4f5
- MD5 9bc1878c601d5ec2f89072c8a518353c
- SHA1 5c923cabfa9b3bdb2a446ad589a884786f0758de
- SHA512 7e6799505197228a164c128e97f6744299300765046bf813b87f085f119ffa8757d9253c5f5bcf56f7602e4e0994b5983358d64d90c409b5aaf254cd55541f99
- SSDEEP 192:4jWpbxkf6e0r/otG7zeHiBlFXCpPItZarLVEw/0Jvtuii+RWXd0noxVk:Dbfey/OGIvPPrLVEwcJijeoxu
- TLSH
  T1CB325190F6829E8FFCB6F2F1205A6350AB35D3371B6DB1235511D02A2E496C81E79F4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  resources/hydra-python-rpc/lib/multiprocessing/util.pyc
- Size 11KB
- SHA256 bf33fcad56fd2a877402370baec5b95e321820ca31da2c1038b6c6e22dbc9ed5
- MD5 8a14f4c91dcba28adde02a10a0891b74
- SHA1 0a787ee9a862aa1138b772ea60256acc2f583961
- SHA512 a3e6bbbc4f47da51dd26a6b0f9b286f4f5655d4762ae81342d11b2fd92d8cc2f1f23830ec92035a80d9b5b5c77f1ff94179795c4e2fd904e34d42eaf1182399b
- SSDEEP 192:IM+oNF2F3cpmXOc5s/b+zVXTzlVbhUNY9+FcPJr2TVcz3:3+FM0XhS/6zRlV9UZGSTV0
- TLSH
  T1D932F4C4C646BE5AFCBCF3BC123A9360AA95DB7A036D811285C8C0CA2F057D44CB5E47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  resources/hydra-python-rpc/lib/pyexpat.pyd
- Size 201KB
- SHA256 f32af8a21c016702647a83661eb4460bac7c791754cb1faaf1c4d096a94cd7cb
- MD5 3ee5ec36b631c2352cd8bd2e4b58b37f
- SHA1 d6ddab5eb14226fea6e5212382b5dd39aa50df97
- SHA512 873f72bc481bf6c55cdd00e97ea0e5946f466790f3319374b1c15772d4abdc7f394defd2cb130323fff2169380b0cda7319bb2b19f87ed5dfa479635f4b21317
- SSDEEP 6144:Hd/B8sD4Om8J1YmL5HQUWdrHy1lfT5uwt:HnJDXT/QU4wEwt
- TLSH
  T1C8146B577196C0EBE8838038D6938F07CA72B8A5479097CF02E4E6BD5F23B523E69355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  resources/hydra-python-rpc/lib/select.pyd
- Size 29KB
- SHA256 71ed480da28968a7fd07934e222ae87d943677468936fd419803280d0cad07f3
- MD5 35bb285678b249770dda3f8a15724593
- SHA1 a91031d56097a4cbf800a6960e229e689ba63099
- SHA512 956759742b4b47609a57273b1ea7489ce39e29ebced702245a9665bb0479ba7d42c053e40c6dc446d5b0f95f8cc3f2267af56ccaaaf06e6875c94d4e3f3b6094
- SSDEEP 768:HYyAU1265whz9HqRORWJIW7G1YiSyv4eED:z86GhhKRORWJIW7G17SygR
- TLSH
  T161D26C52AB6864C6DAA39571D8E52F0FE43476274710C3CF2365C2291F227C1BBBE399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  resources/hydra-python-rpc/lib/unicodedata.pyd
- Size 1.1MB
- SHA256 3a0987025f1cf2111dc6e4f59402073ba123d7436d809ee4198b4e7bfb8cb868
- MD5 3ba2a20dda6d1b4670767455bbe32870
- SHA1 7c98221bc6ed763030087b1f33fb83eac2823ea4
- SHA512 0688f8af3359a8571bef2a89efabc2dbf26f3f5c6220932a4e7df2e33fac95cafee8b80796346ba698e6bf43630b8069f56538b95a8ff62ec21d629787ca5cd1
- SSDEEP 12288:SeqMmuZ63NBQCb5Pfhnzr0ql8L8kQM7IRG5eeme6VZyrIBHdQLhfFE+uJ7X+:SequaZV0m84MMREtV6Vo4uYJ7X+
- TLSH
  T1F2355909BAC24EE6E89B067940D3117B2F61C1720F0B6B4F76A5532D9C763A34EE653C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/hydra-python-rpc/lib/urllib/__init__.pyc
- Size 158B
- SHA256 bbb677da39f255189044d9e2b467e5b9f182f29f0f5b6a1c918d7784459bbfff
- MD5 89291bae25f3842a8298dee049b0048e
- SHA1 e1a6d2e3fc473471baa416dff4ca2543e647c3f1
- SHA512 acbb52dfa1d1d535881a55d04db62cea37b73080aa6a6788927cc44bde409fb4299905be20151217dff1cb36e366ba1fe26a67808aedf8a6b49138019ee14209
- TLSH
  T177C02B044B53C193F47FB532712D230810C8CE4071C60453084D72042C0C6010E30810
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32