peass | 701e631b4dbae80a7f639d7e73f8c15e6031d70272de9d7635dfb48212567e85

General

Target
2026-10-26_bad6177e5c859d243a8b2d2938c1ec34_darkgate_elex_glassworm_hijackloader_icedid
Size 11.1MB
Sample261027-j4tepacv7l
SHA256 701e631b4dbae80a7f639d7e73f8c15e6031d70272de9d7635dfb48212567e85
MD5 bad6177e5c859d243a8b2d2938c1ec34
SHA1 16d0505751653410ade2c73f368f42c223fd7a8a
SHA512 e5305e413459424d0d4404bf061e1f513695b6717ef854e53f09a86f03ea569dbbf6883a53c881b1a2ae43d68c5846cd850b68ab8680d90b136cb89eb32f64c5
SSDEEP 196608:U9d4uVBFUcwti7TQlyVN8iNIS4TBv9zTUcKQy:UQyHwtQQlyXkdKQ
TLSH
T1CEC6D044A2D90929D5EF0E3D9062023257397716539A8BCBFBCC82980F57FE5CB76326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-26_bad6177e5c859d243a8b2d2938c1ec34_darkgate_elex_glassworm_hijackloader_icedid
- Size 11.1MB
- SHA256 701e631b4dbae80a7f639d7e73f8c15e6031d70272de9d7635dfb48212567e85
- MD5 bad6177e5c859d243a8b2d2938c1ec34
- SHA1 16d0505751653410ade2c73f368f42c223fd7a8a
- SHA512 e5305e413459424d0d4404bf061e1f513695b6717ef854e53f09a86f03ea569dbbf6883a53c881b1a2ae43d68c5846cd850b68ab8680d90b136cb89eb32f64c5
- SSDEEP 196608:U9d4uVBFUcwti7TQlyVN8iNIS4TBv9zTUcKQy:UQyHwtQQlyXkdKQ
- TLSH
  T1CEC6D044A2D90929D5EF0E3D9062023257397716539A8BCBFBCC82980F57FE5CB76326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery peass hacktool persistence privilege_escalation spyware stealer trojan
- Detects PEASS hacktool
- Family: PEASS, PEASS-ng, Peas
  PEASS is an open-source tool for privilege escalation.
  hacktool peass
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables manipulated with Fody
- Custom signature
  
  Detects executables referencing Windows vault credential objects. Observed in infostealers
- Custom signature
  
  Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2