Loading malware…
Hydraq, also known as 9002 RAT, McRat, Aurora, Hidraq, Homeunix, Homux, Mdmbot, and Roarur, is a remote access Trojan/backdoor used since at least 2009 and historically associated with state-sponsored activity. It was identified as the malware used in Operation Aurora, the intrusion campaign that targeted companies including Google and Adobe in the technology, financial, and defense sectors; reporting on that campaign stated the attackers used a zero-day Internet Explorer vulnerability for initial compromise, with some reporting also noting malicious PDF attachments exploiting Adobe Reader/Acrobat vulnerabilities in some attacks. Hydraq establishes persistence by creating new Windows services and corresponding Registry subkeys, and it can later uninstall itself by deleting those values. It creates a backdoor that allows remote attackers to retrieve system information from Registry keys, including CPU speed, load and call DLL functions, monitor services, and clear system event logs. The malware provides extensive data exfiltration capabilities. Hydraq command-and-control traffic is encrypted using bitwise NOT and XOR operations. It also includes a VNC-based component capable of streaming a live feed of the infected host’s desktop. More recent reporting states that Webworm, a threat group linked to Space Pirates and targeting government agencies and enterprises in sectors including IT services, aerospace, and electric power across Russia, Georgia, Mongolia, and other Asian countries, has used customized versions of 9002 RAT/Hydraq and modified its communication protocol, including encryption details, to evade detection. Reported Webworm-related sample hashes for 9002 RAT include dropper 6e46054aa9fd5992a7398e0feee894d5887e70373ca5987fc56cd4c0d28f26a1 and packed backdoor 37fa5108db1ae73475911a5558fba423ef6eee2cf3132e35d3918b9073aeecc1.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
FireEye recently identified another targeted attack campaign that leveraged both the recently announced Internet Explorer zero-day, CVE-2013-1347, as well as recently patched Java exploits CVE-2013-2423 and CVE-2013-1493. ... If a visitor to one of these compromised website was running Internet Explorer 8.0 the malicious javascript would redirect them to a page at www[.]sunshop[.]com[.]tw hosting a CVE-2013-1347 exploit. ... The Internet Explorer (CVE-2013-1347) exploit code pulled down a “9002” RAT from another compromised site at hk[.]sz181[.]com.
The java exploits were packaged as two different jar files. One jar file had a MD5 of f4bee1e845137531f18c226d118e06d7 and exploited CVE-2013-2423. The jar that exploited CVE-2013-2423 dropped a 9002 RAT with a MD5 of d99ed31af1e0ad6fb5bf0f116063e91f. This RAT connected to a command and control server at asp[.]homesvr[.]linkpc[.]net.
The second jar file had a MD5 of 3fbb7321d8610c6e2d990bb25ce34bec and exploited CVE-2013-1493. ... The jar that exploited CVE-2013-1493 dropped a 9002 RAT with a MD5 of 42bd5e7e8f74c15873ff0f4a9ce974cd. ... The exploit site at sunshop[.]com[.]tw previously hosted a different malicious jar file on April 2, 2013. This jar file had a MD5 of 51aff823274e9d12b1a9a4bbbaf8ce00. It exploited CVE-2013-1493 and dropped a Poison Ivy RAT.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The 9002 RAT appears to have been in use since at least 2009 and has historically been used by state-sponsored actors. The malware provides attackers with extensive data exfiltration capabilities. Some variants of 9002 RAT inject into memory and do not write to the disk...
The 9002 RAT appears to have been in use since at least 2009 and has historically been used by state-sponsored actors. The malware provides attackers with extensive data exfiltration capabilities. Some variants of 9002 RAT inject into memory and do not write to the disk...
"MoonTag samples match a YARA rule named 'MAL_APT_9002_SabrePanda' that detects samples from the 9002 RAT malware family..."
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The initial piece of code was shell code encrypted three times and that activated the exploit.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
Catchamas creates three Registry keys to establish persistence by adding a Windows Service ... TEARDROP modified the Registry to create a Windows service for itself ... NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.
The malware then injects svchost.exe with the ability to: Execute commands Download potentially malicious files
Catchamas creates three Registry keys to establish persistence by adding a Windows Service ... TEARDROP modified the Registry to create a Windows service for itself ... NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.
The logexts.dat file is obfuscated... Gh0st RAT ... included features such as layers of obfuscation to bypass security protections and hinder analysis... Changes made by Webworm to this version of 9002 RAT are apparently intended to evade detection.
Changes made by Webworm to this version of 9002 RAT are apparently intended to evade detection. For example, the details of the RAT’s communication protocol, such as encryption, have also been modified by the threat actors.
Previous research on the group’s activity found that it uses custom loaders hidden behind decoy documents... [TEMP]\[RANDOM_DIGITS].doc
The malware then injects svchost.exe with the ability to: Execute commands Download potentially malicious files
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
Once the hackers were in systems, they siphoned off data to command-and-control servers in Illinois, Texas and Taiwan.
"capable of communicating over both HTTP and what appears to be fake SSL... attempts to mimic SSL traffic to login.live[.]com by sending that domain in the SNI field" | "This variant of 9002 is capable of communicating over both HTTP... Data sent to the command and control (C&C) in the HTTP POST’s client body is transmitted in an encoded state"
The RAT’s features include, but are not limited to, the ability to remotely uninstall a file manager, and the ability to download, upload, and execute files.
One of the malicious programs opened a remote backdoor to the computer, establishing an encrypted covert channel that masqueraded as an SSL connection to avoid detection.
One of the malicious programs opened a remote backdoor to the computer, establishing an encrypted covert channel that masqueraded as an SSL connection to avoid detection.
"3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode..."; "APT33 has used AES for encryption of command and control traffic."; "Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode)."; "Duqu ... data stream can be encrypted with AES-CBC."; "PoisonIvy uses the Camellia cipher to encrypt communications."
239 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
49 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A long-used remote access trojan with extensive data exfiltration capabilities. Some variants are memory-injected and diskless. In the Webworm case, the group modified the malware’s communication protocol and encryption to evade detection.
A notorious information stealer delivered by the Kral downloader in mid-2023.
A remote access trojan, also known as Hydraq and McRat, previously used by Webworm before appearing to be abandoned.
Previously used backdoor in Webworm operations before the group shifted to newer custom-built tools.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.