MITRE ATT&CKsoftware (malware)

S0203 Hydraq

Published 2018-04-18 Modified 2024-11-17 Official page ↗
Domain
enterprise
Platforms
Windows
Aliases
Roarur, MdmBot, HomeUnix, Homux, HidraQ, HydraQ, McRat, Aurora, 9002 RAT
Version
2.0
Created
2018-04-18

Description

Hydraq is a data-theft trojan first used by Elderwood in the 2009 Google intrusion known as Operation Aurora, though variations of this trojan have been used in more recent campaigns by other Chinese actors, possibly including APT17.

Related

Uses · MITRE ATT&CK (19)

  • T1685.005 Clear Windows Event Logs sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1569.002 Service Execution sub-technique
  • T1070.004 File Deletion sub-technique
  • T1543.003 Windows Service sub-technique
  • T1134 Access Token Manipulation technique
  • T1005 Data from Local System technique
  • T1007 System Service Discovery technique
  • T1012 Query Registry technique
  • T1016 System Network Configuration Discovery technique
  • T1027 Obfuscated Files or Information technique
  • T1048 Exfiltration Over Alternative Protocol technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1112 Modify Registry technique
  • T1113 Screen Capture technique
  • T1129 Shared Modules technique

Referenced by MITRE ATT&CK · uses (2)

References