peass | 4bbd758dbf54597bf52f5bee80da37620232e7cc30d65d546190c64ee8698f29

General

Target
2026-10-28_7a3c00a939c752d1eb167528cc51a545_darkgate_elex_glassworm_hijackloader_icedid_silence
Size 11.1MB
Sample261028-l6afpszycx
SHA256 4bbd758dbf54597bf52f5bee80da37620232e7cc30d65d546190c64ee8698f29
MD5 7a3c00a939c752d1eb167528cc51a545
SHA1 b7ba7ecc8789cbabe26d9cabcf414865c9c5e11a
SHA512 53da5d4ce5ec947b52ecaa1835a33763ca56b44a91804719cd8f7edfbd04b4ad4d13d87bc9ee83d492a00c1f48dcd6fcf4bb0d07a658ad9eadceab478c5718c7
SSDEEP 196608:OmDaQGXIioVBFUcwti7TQlyVN8iNISRTRmW5Qz:x3oYHwtQQlyXOOQ
TLSH
T1E2C6C00062E90969D6FB1F79907102338A35760613AACBCBB7CC85A81F56FE5CF75326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-28_7a3c00a939c752d1eb167528cc51a545_darkgate_elex_glassworm_hijackloader_icedid_silence
- Size 11.1MB
- SHA256 4bbd758dbf54597bf52f5bee80da37620232e7cc30d65d546190c64ee8698f29
- MD5 7a3c00a939c752d1eb167528cc51a545
- SHA1 b7ba7ecc8789cbabe26d9cabcf414865c9c5e11a
- SHA512 53da5d4ce5ec947b52ecaa1835a33763ca56b44a91804719cd8f7edfbd04b4ad4d13d87bc9ee83d492a00c1f48dcd6fcf4bb0d07a658ad9eadceab478c5718c7
- SSDEEP 196608:OmDaQGXIioVBFUcwti7TQlyVN8iNISRTRmW5Qz:x3oYHwtQQlyXOOQ
- TLSH
  T1E2C6C00062E90969D6FB1F79907102338A35760613AACBCBB7CC85A81F56FE5CF75326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery peass hacktool persistence privilege_escalation ransomware spyware stealer trojan
- Detects PEASS hacktool
- Family: PEASS, PEASS-ng, Peas
  PEASS is an open-source tool for privilege escalation.
  hacktool peass
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables containing URLs to raw contents of a Github gist
- Custom signature
  
  Detects executables manipulated with Fody
- Custom signature
  
  Detects executables packed with Dotfuscator
- Custom signature
  
  Detects executables referencing Windows vault credential objects. Observed in infostealers
- Custom signature
  
  Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Custom signature
  
  detects Windows exceutables potentially bypassing UAC using fodhelper.exe
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2