There are 2 variants:
When the virus is loaded into memory, the virus infects EXE executables that are run. The infection size varies in different files.
This variant mainly infects goat files, and not every file could be infected by this variant. And it might crash the system on infecting files having specified file size.
This variant infects every file that is run, but it does not infect files smaller than 1,000 bytes.
The following table shows the memory usage of the variants.
|Variant||Memory usage in bytes|
Hydra activates on January 1st, the payload runs once only on every section.
This variant displays the following message:
This is Hydra v1.0. Don`t panic, I will not destroy your data.
When an infected program is run, the virus scrambles characters on screen like inside a washing machine, and they move away to right when a key is pressed.
After that it displays the following message:
This is Hydra v1.1. Don`t panic, I will not destroy your data.
When an infected goat file is run on non-activation day, the system may crash by memory allocation error or run into an invalid part of memory.