peass | 892cb3eaa91695beb48cf3f26bd75d7bb3225661507ff064bee0a73261300887

General

Target
2026-10-28_096fea196ddb35724707f652dc3ac29a_darkgate_glassworm_hijackloader_icedid
Size 11.2MB
Sample261030-mx69raec49
SHA256 892cb3eaa91695beb48cf3f26bd75d7bb3225661507ff064bee0a73261300887
MD5 096fea196ddb35724707f652dc3ac29a
SHA1 5d5a559adad1b037958b40a6b553b1e4cd7313e2
SHA512 b5de747ac2a7d0af7a529e3670f8eb165d5af43ade0bc0823999a499d8f73fc03c03c7720dba3085ccbb38ccc6cb6b7885e7836aabb4ffcffd749aee68e25103
SSDEEP 196608:aiIioVBFUcwti7TQlyVN8iNISRTRmW5QsG:aiYHwtQQlyXOOQ
TLSH
T1F2C6C04093E90929D5AB0E3C807102225B397B1657AACFCFB7CC81581F62FE5DB76726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-28_096fea196ddb35724707f652dc3ac29a_darkgate_glassworm_hijackloader_icedid
- Size 11.2MB
- SHA256 892cb3eaa91695beb48cf3f26bd75d7bb3225661507ff064bee0a73261300887
- MD5 096fea196ddb35724707f652dc3ac29a
- SHA1 5d5a559adad1b037958b40a6b553b1e4cd7313e2
- SHA512 b5de747ac2a7d0af7a529e3670f8eb165d5af43ade0bc0823999a499d8f73fc03c03c7720dba3085ccbb38ccc6cb6b7885e7836aabb4ffcffd749aee68e25103
- SSDEEP 196608:aiIioVBFUcwti7TQlyVN8iNISRTRmW5QsG:aiYHwtQQlyXOOQ
- TLSH
  T1F2C6C04093E90929D5AB0E3C807102225B397B1657AACFCFB7CC81581F62FE5DB76726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery peass hacktool persistence privilege_escalation ransomware spyware stealer trojan
- Detects PEASS hacktool
- Family: PEASS, PEASS-ng, Peas
  PEASS is an open-source tool for privilege escalation.
  hacktool peass
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables manipulated with Fody
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- detects Windows exceutables potentially bypassing UAC using fodhelper.exe
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2