peass | 50ceb6af8f574aaafa0d3ee21569cd60fdc795127fa9a0fbc73f51fa9c14f794

General

Target
2026-11-05_f1d3f27c10ede65224788d66a9471fce_darkgate_elex_glassworm_hijackloader_icedid_silence
Size 12.7MB
Sample261106-dytwdawwft
SHA256 50ceb6af8f574aaafa0d3ee21569cd60fdc795127fa9a0fbc73f51fa9c14f794
MD5 f1d3f27c10ede65224788d66a9471fce
SHA1 5540b30bcc4da932b5b8b1ccd49a98e9b3427742
SHA512 96ffdee43b840c7ddb660f4fbc28a0a78025caccce18ced772b56b7fe158c15e85e1026baeca075768f899a5491ac05e8772d5f306215ca1c91491609c726dc4
SSDEEP 196608:vmDaQGXIioVBFUcwti7TQlyVN8iNISRTRmW5Q/n:u3oYHwtQQlyXOOQ
TLSH
T118D6AE0073E90959E6FB1F39907102228A36BA461776CBCF778C81A81F67FD58E75326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-05_f1d3f27c10ede65224788d66a9471fce_darkgate_elex_glassworm_hijackloader_icedid_silence
- Size 12.7MB
- SHA256 50ceb6af8f574aaafa0d3ee21569cd60fdc795127fa9a0fbc73f51fa9c14f794
- MD5 f1d3f27c10ede65224788d66a9471fce
- SHA1 5540b30bcc4da932b5b8b1ccd49a98e9b3427742
- SHA512 96ffdee43b840c7ddb660f4fbc28a0a78025caccce18ced772b56b7fe158c15e85e1026baeca075768f899a5491ac05e8772d5f306215ca1c91491609c726dc4
- SSDEEP 196608:vmDaQGXIioVBFUcwti7TQlyVN8iNISRTRmW5Q/n:u3oYHwtQQlyXOOQ
- TLSH
  T118D6AE0073E90959E6FB1F39907102228A36BA461776CBCF778C81A81F67FD58E75326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery peass hacktool persistence privilege_escalation ransomware spyware stealer trojan
- Detects PEASS hacktool
- Family: PEASS, PEASS-ng, Peas
  PEASS is an open-source tool for privilege escalation.
  hacktool peass
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables containing URLs to raw contents of a Github gist
- Custom signature
  
  Detects executables manipulated with Fody
- Custom signature
  
  Detects executables packed with Dotfuscator
- Custom signature
  
  Detects executables referencing Windows vault credential objects. Observed in infostealers
- Custom signature
  
  Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Custom signature
  
  detects Windows exceutables potentially bypassing UAC using fodhelper.exe
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2