peass | bc36af974c96445e6e9e323404ce0d1283c0ecaf68af03c551aae031f253ece6

General

Target
2026-11-09_2b5f9e5011a26511ea1e4898e22f6de1_darkgate_elex_glassworm_hijackloader_icedid_silence
Size 13.0MB
Sample261111-aansnsdy5y
SHA256 bc36af974c96445e6e9e323404ce0d1283c0ecaf68af03c551aae031f253ece6
MD5 2b5f9e5011a26511ea1e4898e22f6de1
SHA1 90d143e70dbfaee58c80072394d5dddf255e8894
SHA512 80aac3b1e5c0b4ec8d293d566c236c08e8e48c5890fe225a0d57a347e1a0a93d6caf7e8bd8625ef664354e86048d743b1ccd0acbc77807990d744a7712dfc0c0
SSDEEP 196608:xOcS6hIiZVBFUcwti7TQlyVN8iNISRTRmW5Qie:C2VHwtQQlyXOOQ
TLSH
T128D6AE0073E90929D6BB1F39D17202224A367A06176ACBCFB78C81A81F56FD5CF75726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-09_2b5f9e5011a26511ea1e4898e22f6de1_darkgate_elex_glassworm_hijackloader_icedid_silence
- Size 13.0MB
- SHA256 bc36af974c96445e6e9e323404ce0d1283c0ecaf68af03c551aae031f253ece6
- MD5 2b5f9e5011a26511ea1e4898e22f6de1
- SHA1 90d143e70dbfaee58c80072394d5dddf255e8894
- SHA512 80aac3b1e5c0b4ec8d293d566c236c08e8e48c5890fe225a0d57a347e1a0a93d6caf7e8bd8625ef664354e86048d743b1ccd0acbc77807990d744a7712dfc0c0
- SSDEEP 196608:xOcS6hIiZVBFUcwti7TQlyVN8iNISRTRmW5Qie:C2VHwtQQlyXOOQ
- TLSH
  T128D6AE0073E90929D6BB1F39D17202224A367A06176ACBCFB78C81A81F56FD5CF75726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery peass hacktool persistence privilege_escalation ransomware spyware stealer trojan
- Detects PEASS hacktool
- Family: PEASS, PEASS-ng, Peas
  PEASS is an open-source tool for privilege escalation.
  hacktool peass
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables containing URLs to raw contents of a Github gist
- Custom signature
  
  Detects executables manipulated with Fody
- Custom signature
  
  Detects executables packed with Dotfuscator
- Custom signature
  
  Detects executables referencing Windows vault credential objects. Observed in infostealers
- Custom signature
  
  Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Custom signature
  
  detects Windows exceutables potentially bypassing UAC using fodhelper.exe
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2