peass | a6c8a8067283cc95575e49a23ba7311f9057ba20d24df58b3c3f7f513ba00994

General

Target
2026-10-03_5718497a2b5c957e201be11913e5f27d_darkgate_glassworm_hijackloader_icedid
Size 10.8MB
Sample261004-pawwlsst2m
SHA256 a6c8a8067283cc95575e49a23ba7311f9057ba20d24df58b3c3f7f513ba00994
MD5 5718497a2b5c957e201be11913e5f27d
SHA1 b79858b91f9d8ceef4b21f559f561af93ce52cd6
SHA512 18a717834f3305b531dd82179c7aaa8355e8b5802dfb09ea10827614b001b70c2b1f414ca0fac55ff64ace0791a19f51d49d24a9b4e68853c6de59cefcb2fe74
SSDEEP 196608:3dmXIiPVBFUcwti7TQlyVN8iNISRTRmW5QGc:cX/HwtQQlyXOOQ
TLSH
T139B6D004A2ED0929D5AF4E3D906202235B35370A179ACBCBBBCC81581F57FE6D776326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-03_5718497a2b5c957e201be11913e5f27d_darkgate_glassworm_hijackloader_icedid
- Size 10.8MB
- SHA256 a6c8a8067283cc95575e49a23ba7311f9057ba20d24df58b3c3f7f513ba00994
- MD5 5718497a2b5c957e201be11913e5f27d
- SHA1 b79858b91f9d8ceef4b21f559f561af93ce52cd6
- SHA512 18a717834f3305b531dd82179c7aaa8355e8b5802dfb09ea10827614b001b70c2b1f414ca0fac55ff64ace0791a19f51d49d24a9b4e68853c6de59cefcb2fe74
- SSDEEP 196608:3dmXIiPVBFUcwti7TQlyVN8iNISRTRmW5QGc:cX/HwtQQlyXOOQ
- TLSH
  T139B6D004A2ED0929D5AF4E3D906202235B35370A179ACBCBBBCC81581F57FE6D776326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery peass hacktool persistence privilege_escalation ransomware spyware stealer trojan
- Detects PEASS hacktool
- Family: PEASS, PEASS-ng, Peas
  PEASS is an open-source tool for privilege escalation.
  hacktool peass
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables manipulated with Fody
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2