S0203 Hydraq

malwareEnterprise

platformsWindows

also known asHydraq · Roarur · MdmBot · HomeUnix · Homux · HidraQ · HydraQ · McRat · Aurora · 9002 RAT

Hydraq is a data-theft trojan first used by Elderwood in the 2009 Google intrusion known as Operation Aurora, though variations of this trojan have been used in more recent campaigns by other Chinese actors, possibly including APT17.

techniques used (19)

ATT&CK techniques this enables or maps to.

T1005Data from Local System
T1007System Service Discovery
T1012Query Registry
T1016System Network Configuration Discovery
T1027Obfuscated Files or Information
T1048Exfiltration Over Alternative Protocol
T1057Process Discovery
T1070.004File Deletion
T1082System Information Discovery
T1083File and Directory Discovery
T1105Ingress Tool Transfer
T1112Modify Registry
T1113Screen Capture
T1129Shared Modules
T1134Access Token Manipulation
T1543.003Windows Service
T1569.002Service Execution
T1573.001Symmetric Cryptography
T1685.005Clear Windows Event Logs

used by groups (2)

Threat groups associated with this.

G0001Axiom
G0066Elderwood

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan