Home Malware Programs Trojans Hydraq

Hydraq

Posted: January 18, 2010

Threat Metric

Threat Level: 8/10
Infected PCs: 83
First Seen: January 19, 2011
OS(es) Affected: Windows

Hydraq is a Trojan that opens up a backdoor for malware to enter the system and has received media attention due to its connection with the cyber attack on Google. The hack attack targeted Gmail accounts of human rights activists who were involved in China rights issues. Hydraq may infect a users computer through a document attachment of a spam email message or an unpatched vulnerability in Microsoft's Internet Explorer. Once Hydraq has installed on a compromised computer, it uses a backdoor to listen for incoming commands, which allow Hydraq to generate malicious tasks.

Hydraq permits the attacker to carry out the following malicious tasks: modify the registry subkeys, delete files, execute and modify attributes, reboot or turn of the computer, alter token privileges, read and delete the %System%driversetcnetworks.ics file, and erase all system event logs. Hydraq also inspects if %System%acelpvc.dll is present so it can load it and call its EntryMain() export.

Hydraq attachs itself as the system service RaS[FOUR RANDOM CHARACTERS] and its "ImagePath" value is made to begin svchost.exe. To get svchost.exe to know the existence of Hydraq and be loaded, Hydraq adds its service name into the list of service names stored in the "netsvcs" value of the registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvcHost.

Hydraq can generate a copy of itself under a random filename in the %TEMP% directory or under the name %TEMP%c_1758.nls. We recommend that you obtain patches to fix Microsoft vulnerabilities and keep security software up-to-date.

Related Posts

Loading...