c074bd257e4053ccc77ca5a53a6a43d6abead647b583aea8472f423cae39957c

General

Target
HingeApp.7z
Size 122.0MB
Sample260805-qjg99aycje
SHA256 c074bd257e4053ccc77ca5a53a6a43d6abead647b583aea8472f423cae39957c
MD5 b2a940a115201cf9b8c874b182d1f983
SHA1 b114110610260593e08e74840d0b15e4d7af53fd
SHA512 71932fe33704dc0e7f304ba038c9db883d4880d347fafb7df97a1f709328eefcb06946aa4b6ffdf1bc4b8b97d21d140ed24bc70b3722bd492f8c54a52bb54e12
SSDEEP 3145728:gOEfMZWmdQZkD0RMqG6FkAVB3PcbCYCfTIOIWqW/OocXAk1/:gJfMZNdQZir854C5bfIWqW/ncXl/
TLSH
T1F65833BCE661BCC1CA81BC29285D958F43FC43A29583F96897BC63B161D7EA514F804F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  HingeApp.exe
- Size 122.3MB
- SHA256 1b24e87529d5e983d73ab720b376ccc713f6d196672cb020e768d5a94afa54df
- MD5 73d5592405e66fc163fd448970e753ff
- SHA1 143691c3c1ecb9799643e10f49d594dda59ea64f
- SHA512 24062e3e2ec0c530bdd51c3cce72b77876edc266de880580c7e23eadafb9b397daf4af14dfaf999bd46ff12a32772cc5f894280940aa83f800afb597ca53f38d
- SSDEEP 3145728:hUTm4PB81C9kFux0VcVKRbTIukCH1yVN6D/NYvelQSnMcYI5/:iC4PBkC9kMiEKVy36lYvelQwMcd/
- TLSH
  T15D5833B8A2216891C780683538D8D56FCFAC7E9E8543F5685FFB3B7371B2A6510F404A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  Application.exe
- Size 169.1MB
- SHA256 73125e96099b101f8fc550d1aac2fbb1475c80e00e40e7f214a865628eb6936b
- MD5 3da3f1ed095c64690e1b5e1dd0320bae
- SHA1 7b7d09ae3fb952dd0f72761dddc35eb7f0ab4a75
- SHA512 5a75562cfc4c1248968f1d3dbf7836c2b08b64a4986c940fc925984d039e7a86513e329a5c4c774298ba50e1a83e30a9dfcf0617e5db32ef3b775b97d4cfb17c
- SSDEEP 1572864:fMw5SJUgPbksdRW8YcrVEGPv/fNsYCdwl0KWCfLM14GYoQt0imGWgyTpQGa:DunRK2agyVQ1
- TLSH
  T13C888C13E29A50D9E00DD1B187879233EA72BC4A4728B6DF2A5417563F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution persistence spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral2