peass | 9169262007992835951fa34974ca1adde12d4c041c4330c0e18b0e448699326e

General

Target
2026-10-30_5493def89748efb4769966f1949e79d4_darkgate_glassworm_hijackloader_icedid
Size 11.2MB
Sample261031-d1bgtaat3j
SHA256 9169262007992835951fa34974ca1adde12d4c041c4330c0e18b0e448699326e
MD5 5493def89748efb4769966f1949e79d4
SHA1 0bb27c96948e96653252f566486eb9109d1aa13c
SHA512 36a1d60694a94c4c21244b4c558739ea0a1e572067f2f91c4c98ba0db480e4e2e8bc213b3519c6cfd6ab7a58d81f37d4f0847a9e4be4ca9bcd1c9ee254e22cc8
SSDEEP 196608:3iIioVBFUcwti7TQlyVN8iNISRTRmW5QD2u:3iYHwtQQlyXOOQ6
TLSH
T155C6CF4453E90929D5BB0E3C80B102221B397A1657AACFCFB7CC81581F62FE5DB76726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-30_5493def89748efb4769966f1949e79d4_darkgate_glassworm_hijackloader_icedid
- Size 11.2MB
- SHA256 9169262007992835951fa34974ca1adde12d4c041c4330c0e18b0e448699326e
- MD5 5493def89748efb4769966f1949e79d4
- SHA1 0bb27c96948e96653252f566486eb9109d1aa13c
- SHA512 36a1d60694a94c4c21244b4c558739ea0a1e572067f2f91c4c98ba0db480e4e2e8bc213b3519c6cfd6ab7a58d81f37d4f0847a9e4be4ca9bcd1c9ee254e22cc8
- SSDEEP 196608:3iIioVBFUcwti7TQlyVN8iNISRTRmW5QD2u:3iYHwtQQlyXOOQ6
- TLSH
  T155C6CF4453E90929D5BB0E3C80B102221B397A1657AACFCFB7CC81581F62FE5DB76726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery peass hacktool persistence privilege_escalation ransomware spyware stealer trojan
- Detects PEASS hacktool
- Family: PEASS, PEASS-ng, Peas
  PEASS is an open-source tool for privilege escalation.
  hacktool peass
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables containing URLs to raw contents of a Github gist
- Custom signature
  
  Detects executables manipulated with Fody
- Custom signature
  
  Detects executables referencing Windows vault credential objects. Observed in infostealers
- Custom signature
  
  Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Custom signature
  
  detects Windows exceutables potentially bypassing UAC using fodhelper.exe
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2