Symantec Hydraq Jan 2010

Hydraq creates a backdoor through which remote attackers can read data from files.

Hydraq creates a backdoor through which remote attackers can monitor services.

Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.

Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.

Hydraq connects to a predefined domain on port 443 to exfil gathered information.

Hydraq creates a backdoor through which remote attackers can monitor processes.

Hydraq creates a backdoor through which remote attackers can delete files.

Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.

Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.

Hydraq creates a backdoor through which remote attackers can download files and additional malware components.

Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. Hydraq's backdoor also enables remote attackers to modify and delete subkeys.

Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.

Hydraq creates a backdoor through which remote attackers can load and call DLL functions.

Hydraq creates a backdoor through which remote attackers can adjust token privileges.

Hydraq creates new services to establish persistence.

Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.

Hydraq creates a backdoor through which remote attackers can clear all system event logs.