General
- Target hydra-installer.exe
- Size 10.9MB
- Sample261102-vee2jsdx8m
- SHA256 9ce0713c0173d8592633b2e31aba87cce30f7308a03336636c7e8b9f354dbdab
Score
8/10
Malware Config
Targets
-
- Target hydra-installer.exe
- Size 10.9MB
- SHA256 9ce0713c0173d8592633b2e31aba87cce30f7308a03336636c7e8b9f354dbdab
Score8/10-
Contacts a large (1478) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Network Share Discovery
Attempt to gather information on host network.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Process Discovery
1Query Registry
3System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1