General
- Target hydra-installer.exe
- Size 10.9MB
- Sample261027-v32v8aey7y
- SHA256 9ce0713c0173d8592633b2e31aba87cce30f7308a03336636c7e8b9f354dbdab
Score
8/10
Malware Config
Targets
-
- Target hydra-installer.exe
- Size 10.9MB
- SHA256 9ce0713c0173d8592633b2e31aba87cce30f7308a03336636c7e8b9f354dbdab
Score8/10Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Network Share Discovery
Attempt to gather information on host network.
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Network Share Discovery
1Process Discovery
1Query Registry
4System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1