peass | 95432fa2b7506fb02d868df26bc5d9760914a5353ff6468ed220ced14e8594db

General

Target
2026-10-28_c51f774dea380bd9b856781df25a0d7c_darkgate_elex_glassworm_hijackloader_icedid_silence
Size 11.1MB
Sample261028-h5ykcsa17m
SHA256 95432fa2b7506fb02d868df26bc5d9760914a5353ff6468ed220ced14e8594db
MD5 c51f774dea380bd9b856781df25a0d7c
SHA1 7c9f674dc0afc6d7d032fb41f8f97fbf397e8100
SHA512 5b3b1c6a9c7e776b8d0b94fc76d29e4efe8d6a1b52e751e5315db80f41b6b2d85111db90a5970ffad501ab36dcf865ddae80f76c45df2cd037957d9e1fdfc87c
SSDEEP 196608:VmDaQGXIioVBFUcwti7TQlyVN8iNISRTRmW5Q+:s3oYHwtQQlyXOOQ
TLSH
T18AC6C00062E90969D6FB1F79907102338A35760613AACBCBB7CC85A81F56FE5CF75326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-28_c51f774dea380bd9b856781df25a0d7c_darkgate_elex_glassworm_hijackloader_icedid_silence
- Size 11.1MB
- SHA256 95432fa2b7506fb02d868df26bc5d9760914a5353ff6468ed220ced14e8594db
- MD5 c51f774dea380bd9b856781df25a0d7c
- SHA1 7c9f674dc0afc6d7d032fb41f8f97fbf397e8100
- SHA512 5b3b1c6a9c7e776b8d0b94fc76d29e4efe8d6a1b52e751e5315db80f41b6b2d85111db90a5970ffad501ab36dcf865ddae80f76c45df2cd037957d9e1fdfc87c
- SSDEEP 196608:VmDaQGXIioVBFUcwti7TQlyVN8iNISRTRmW5Q+:s3oYHwtQQlyXOOQ
- TLSH
  T18AC6C00062E90969D6FB1F79907102338A35760613AACBCBB7CC85A81F56FE5CF75326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery peass hacktool persistence privilege_escalation ransomware spyware stealer trojan
- Detects PEASS hacktool
- Family: PEASS, PEASS-ng, Peas
  PEASS is an open-source tool for privilege escalation.
  hacktool peass
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables containing URLs to raw contents of a Github gist
- Custom signature
  
  Detects executables manipulated with Fody
- Custom signature
  
  Detects executables packed with Dotfuscator
- Custom signature
  
  Detects executables referencing Windows vault credential objects. Observed in infostealers
- Custom signature
  
  Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Custom signature
  
  detects Windows exceutables potentially bypassing UAC using fodhelper.exe
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2