peass | 7eb30f472b60661d026537702465b5c54079810bed8bfa34a7d8fe361b0a3f9a

General

Target
2026-11-05_255f60230faa3049bba2b515383a3c8c_darkgate_elex_glassworm_hijackloader_icedid_silence
Size 12.7MB
Sample261107-hndtmabw7r
SHA256 7eb30f472b60661d026537702465b5c54079810bed8bfa34a7d8fe361b0a3f9a
MD5 255f60230faa3049bba2b515383a3c8c
SHA1 003ffb319b16b85a600cac8cdd23beb53bc81b0c
SHA512 ff5fff3d5024d88bfe575bc304897a992cac1d97d737ee01552e467d55c6eb7f92b1003b8a57e20273fe369de9a9c7d908edcd7e48c97c69f1fdf2ef847b4773
SSDEEP 196608:umDaQGXIioVBFUcwti7TQlyVN8iNISRTRmW5QGhly:R3oYHwtQQlyXOOQGX
TLSH
T16AD6AE0073E90959E6FB1B39907102228A36BA061776CBCF778C81A81F67FD5CE75726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-05_255f60230faa3049bba2b515383a3c8c_darkgate_elex_glassworm_hijackloader_icedid_silence
- Size 12.7MB
- SHA256 7eb30f472b60661d026537702465b5c54079810bed8bfa34a7d8fe361b0a3f9a
- MD5 255f60230faa3049bba2b515383a3c8c
- SHA1 003ffb319b16b85a600cac8cdd23beb53bc81b0c
- SHA512 ff5fff3d5024d88bfe575bc304897a992cac1d97d737ee01552e467d55c6eb7f92b1003b8a57e20273fe369de9a9c7d908edcd7e48c97c69f1fdf2ef847b4773
- SSDEEP 196608:umDaQGXIioVBFUcwti7TQlyVN8iNISRTRmW5QGhly:R3oYHwtQQlyXOOQGX
- TLSH
  T16AD6AE0073E90959E6FB1B39907102228A36BA061776CBCF778C81A81F67FD5CE75726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery peass hacktool persistence privilege_escalation ransomware spyware stealer trojan
- Detects PEASS hacktool
- Family: PEASS, PEASS-ng, Peas
  PEASS is an open-source tool for privilege escalation.
  hacktool peass
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables containing URLs to raw contents of a Github gist
- Custom signature
  
  Detects executables manipulated with Fody
- Custom signature
  
  Detects executables packed with Dotfuscator
- Custom signature
  
  Detects executables referencing Windows vault credential objects. Observed in infostealers
- Custom signature
  
  Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Custom signature
  
  detects Windows exceutables potentially bypassing UAC using fodhelper.exe
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2