Extracted

• • Target

    2024-12-21_cd8c9c36edc9923a3dbd7f48a6fef81b_smoke-loader_wapomi

  • Size

    57KB

  • MD5

    cd8c9c36edc9923a3dbd7f48a6fef81b

  • SHA1

    dcbad2961541c6f0be5abbcd947f53c3db20da34

  • SHA256

    a61920b3412ad84675b2c615ba19f9fee91c3ac333cbed5c31c1f8173f3e306d

  • SHA512

    1cd20dab8f8d0dbf8f87a5e3b9ee35215a884c5745a17fb45c80ce596db10b898ed2852f3e957106c9f3836db14e293a6b4ca7ba29263086a94b0d4a647e0098

  • SSDEEP

    1536:Osn6bTxKlPWg3+Gs3rZHo66PCVjGCq2iW7z:OpJKlWg3N2Ho/PCtGCH

  Score

  10^/10

  bdaejecaspackv2backdoordiscoveryupx

  • Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec

  • Bdaejec family

    bdaejec

  • Detects Bdaejec Backdoor.

    Bdaejec is backdoor written in C++.

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2