Fandom

Malware Wiki

Hydra

1,327pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.Hydra is a memory resident parasitic virus on DOS.

There are 2 variants:

  • Virus.DOS.Hydra.1162
  • Virus.DOS.Hydra.1649

BehaviorEdit

When the virus is loaded into memory, the virus infects EXE executables that are run. The infection size varies in different files.

Hydra.1162Edit

This variant mainly infects goat files, and not every file could be infected by this variant. And it might crash the system on infecting files having specified file size.

Hydra.1649Edit

This variant infects every file that is run, but it does not infect files smaller than 1,000 bytes.

Memory usageEdit

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Hydra.1162 1,504
Hydra.1649 1,984

PayloadEdit

Hydra activates on January 1st, the payload runs once only on every section.

Hydra.1162Edit

This variant displays the following message:

This is Hydra v1.0.
Don`t panic, I will not destroy your data.

Hydra.1649Edit

When an infected program is run, the virus scrambles characters on screen like inside a washing machine, and they move away to right when a key is pressed.

After that it displays the following message:

This is Hydra v1.1.
Don`t panic, I will not destroy your data.
Hydra1649

Hydra.1649 in action

Other detailsEdit

When an infected goat file is run on non-activation day, the system may crash by memory allocation error or run into an invalid part of memory.

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.